Analysis
-
max time kernel
149s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2024 09:30
Static task
static1
Behavioral task
behavioral1
Sample
documents.exe
Resource
win7-20231215-en
General
-
Target
documents.exe
-
Size
877KB
-
MD5
173aa6b5c260b3e19f1b979f054b02b0
-
SHA1
9ea4da05677968a322acf4330699e76b31676130
-
SHA256
0dd421edda69a829b7b9d025fd81f947085c0b3a54d9025312823a56c2b5df83
-
SHA512
29415d7778eb7d1275815f1bcee0c3f0613f300df29172ab03d63c119491af6ced57c25c39ed27e010c0e7ce7be87de216bf2757480db9fd392b95c1f8282d51
-
SSDEEP
24576:L/UAc8bshd1ixMpqvhnjqJR33ulonktC+FMIpSmUrSGG:L/U8bI1+MMv5YwloWCZU0m7
Malware Config
Extracted
darkcloud
- email_from
- email_to
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
documents.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-1168293393-3419776239-306423207-1000\Control Panel\International\Geo\Nation documents.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
documents.exedescription pid process target process PID 1188 set thread context of 2080 1188 documents.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
documents.exepowershell.exepid process 1188 documents.exe 1188 documents.exe 1188 documents.exe 1188 documents.exe 1092 powershell.exe 1092 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
documents.exepowershell.exedescription pid process Token: SeDebugPrivilege 1188 documents.exe Token: SeDebugPrivilege 1092 powershell.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
RegSvcs.exepid process 2080 RegSvcs.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
documents.exedescription pid process target process PID 1188 wrote to memory of 1092 1188 documents.exe powershell.exe PID 1188 wrote to memory of 1092 1188 documents.exe powershell.exe PID 1188 wrote to memory of 1092 1188 documents.exe powershell.exe PID 1188 wrote to memory of 4652 1188 documents.exe schtasks.exe PID 1188 wrote to memory of 4652 1188 documents.exe schtasks.exe PID 1188 wrote to memory of 4652 1188 documents.exe schtasks.exe PID 1188 wrote to memory of 2080 1188 documents.exe RegSvcs.exe PID 1188 wrote to memory of 2080 1188 documents.exe RegSvcs.exe PID 1188 wrote to memory of 2080 1188 documents.exe RegSvcs.exe PID 1188 wrote to memory of 2080 1188 documents.exe RegSvcs.exe PID 1188 wrote to memory of 2080 1188 documents.exe RegSvcs.exe PID 1188 wrote to memory of 2080 1188 documents.exe RegSvcs.exe PID 1188 wrote to memory of 2080 1188 documents.exe RegSvcs.exe PID 1188 wrote to memory of 2080 1188 documents.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\documents.exe"C:\Users\Admin\AppData\Local\Temp\documents.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1188 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\sTIDCEmUa.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1092 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\sTIDCEmUa" /XML "C:\Users\Admin\AppData\Local\Temp\tmpAD57.tmp"2⤵
- Creates scheduled task(s)
PID:4652 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Suspicious use of SetWindowsHookEx
PID:2080
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
1KB
MD50435b831fa39f2440518e588337248db
SHA1b1113437be1ab9891ab18885df5b997095b8db25
SHA256624f2e0284b92f2963bdc1cdf1dbc726a36568532e62f74991d85a219af3e6c4
SHA51206b69539b0e60669c80d1470195fdd5540dbcb379175e53c1d0d65d517d8a0524b5d8cfcee70f1a058a0b939ee0d8cc0a13a9a088d9b33142966eb5fe7e59ea3