Analysis
-
max time kernel
147s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
13-02-2024 00:14
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
97fbd431a2f9c35f8a680cb894ed9687.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
97fbd431a2f9c35f8a680cb894ed9687.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
97fbd431a2f9c35f8a680cb894ed9687.exe
-
Size
22KB
-
MD5
97fbd431a2f9c35f8a680cb894ed9687
-
SHA1
ed421ca2f0daa2c301a526173fa368030d498489
-
SHA256
09f622da7f26ae8a89ecf789001cbc577be49f092739e368c1b61d9e55139e8b
-
SHA512
46be5a0eb369cd6705678ee56a5031aa5a7dd0bf64261db713a376e9c1e8683319bda8f5fc4711458bcbb8e4c5d9e93aa2805ec01fce5385da9880ea5900fc0e
-
SSDEEP
384:+h/3opT7goadaeBM/Tc26mlnmCiz6mBbOupgoC7+knM2fZ8baRmHU3dxjKY:04pnvadK/llnmPz91O7oegIZI/03dx
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation 97fbd431a2f9c35f8a680cb894ed9687.exe -
Loads dropped DLL 1 IoCs
pid Process 1228 97fbd431a2f9c35f8a680cb894ed9687.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\6457aed.drv 97fbd431a2f9c35f8a680cb894ed9687.exe File opened for modification C:\Windows\SysWOW64\66AFCB56.cfg 97fbd431a2f9c35f8a680cb894ed9687.exe File opened for modification C:\Windows\SysWOW64\66AFCB56.dll 97fbd431a2f9c35f8a680cb894ed9687.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLsID 97fbd431a2f9c35f8a680cb894ed9687.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66AFCB56-FAA9-42D2-8C72-2767A46C7FA8} 97fbd431a2f9c35f8a680cb894ed9687.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66AFCB56-FAA9-42D2-8C72-2767A46C7FA8}\InprocServer32 97fbd431a2f9c35f8a680cb894ed9687.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66AFCB56-FAA9-42D2-8C72-2767A46C7FA8}\InprocServer32\ = "66AFCB56.dll" 97fbd431a2f9c35f8a680cb894ed9687.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{66AFCB56-FAA9-42D2-8C72-2767A46C7FA8}\InprocServer32\ThreadingModel = "Apartment" 97fbd431a2f9c35f8a680cb894ed9687.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLsID\{66AFCB56-FAA9-42D2-8C72-2767A46C7FA8}\InprocServer32 97fbd431a2f9c35f8a680cb894ed9687.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 97fbd431a2f9c35f8a680cb894ed9687.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 1228 97fbd431a2f9c35f8a680cb894ed9687.exe 1228 97fbd431a2f9c35f8a680cb894ed9687.exe 1228 97fbd431a2f9c35f8a680cb894ed9687.exe 1228 97fbd431a2f9c35f8a680cb894ed9687.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 672 Process not Found 672 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe Token: SeDebugPrivilege 1228 97fbd431a2f9c35f8a680cb894ed9687.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1228 97fbd431a2f9c35f8a680cb894ed9687.exe 1228 97fbd431a2f9c35f8a680cb894ed9687.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1228 97fbd431a2f9c35f8a680cb894ed9687.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1228 wrote to memory of 1420 1228 97fbd431a2f9c35f8a680cb894ed9687.exe 84 PID 1228 wrote to memory of 1420 1228 97fbd431a2f9c35f8a680cb894ed9687.exe 84 PID 1228 wrote to memory of 1420 1228 97fbd431a2f9c35f8a680cb894ed9687.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\97fbd431a2f9c35f8a680cb894ed9687.exe"C:\Users\Admin\AppData\Local\Temp\97fbd431a2f9c35f8a680cb894ed9687.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1228 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\97FBD4~1.EXE >> NUL2⤵PID:1420
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12KB
MD57b0f8014a629738baf082fcb1f34f776
SHA1da9bca968570ea1df66a300729d1b1374a5de314
SHA256e38c048031b25da49a09ba3d40ecee65d5875d2b98625bdf7b6289fe581c9a2c
SHA512f3e9e53c3988cefebb8d6f0ff6139447c13ed40adf1930b2b38ad51b9c1f5e90fc8dde2664cd5345a75f56a7759a232daa1fed721498e100c4cc98c7f296143d