2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f

Analysis

max time kernel
143s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
13-02-2024 02:32

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe
Size

1008KB
MD5

997ea9f1ccc67db15ec3a551f932bd25
SHA1

4bb20cd3579475c5d43866854b81b5bea6352fc8
SHA256

2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f
SHA512

4254726491717eefc4a8874d75a6e7fd0f034cebc83c61e4ea11f767c69ad312083cf160a6f5743346b8d227049a424d1f018be85776cd3c7eb10c0aac91c73f
SSDEEP

24576:UXn8krIG6w+Fwdw1BCNs5pDhfz87brh8p:o8mLMwm1BCNGVfz87h

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 492 set thread context of 4600	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	92

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4148	4600	WerFault.exe	92

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
948	schtasks.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe
492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe
4400	powershell.exe
4400	powershell.exe
4600	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe
4600	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe
Token: SeDebugPrivilege	4400	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 492 wrote to memory of 4400	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	88
PID 492 wrote to memory of 4400	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	88
PID 492 wrote to memory of 4400	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	88
PID 492 wrote to memory of 948	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	90
PID 492 wrote to memory of 948	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	90
PID 492 wrote to memory of 948	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	90
PID 492 wrote to memory of 4600	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	92
PID 492 wrote to memory of 4600	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	92
PID 492 wrote to memory of 4600	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	92
PID 492 wrote to memory of 4600	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	92
PID 492 wrote to memory of 4600	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	92
PID 492 wrote to memory of 4600	492	2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe	92

C:\Users\Admin\AppData\Local\Temp\2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe
"C:\Users\Admin\AppData\Local\Temp\2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe"
1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:492
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\BLHFOeXtlRDR.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4400
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\BLHFOeXtlRDR" /XML "C:\Users\Admin\AppData\Local\Temp\tmpABB1.tmp"
  2⤵
  - Creates scheduled task(s)
  PID:948
- C:\Users\Admin\AppData\Local\Temp\2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe
  "C:\Users\Admin\AppData\Local\Temp\2042bdcc5e440b757cd0597bb185d6cde9659b0f7950809acf448a27db3e7b6f.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:4600
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 4600 -s 184
    3⤵
    - Program crash
    PID:4148

C:\Windows\SysWOW64\WerFault.exe
C:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 4600 -ip 4600
1⤵
PID:1524

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_4vuayqie.c2e.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpABB1.tmp

Filesize
1KB

MD5
cbb4e3ec11a8872760367ed182db57b3

SHA1
237c398f78f5f3243a1158966c4ed4b48f7bd04e

SHA256
90e0f9d473e051e070c8534f1e9918d8fb2585bf081c45e9178eed7c7654c5ad

SHA512
74cf332fc57de0bdedbdd901deb99d7a372eb43a2c4f342e4054a6357e9d6f5f523610707bfd6af6302c4fd5248f22db11c6225435bd48233a6e89d09ddcf302

Download Submit
memory/492-6-0x00000000055A0000-0x00000000055B4000-memory.dmp

Filesize
80KB

Download
memory/492-3-0x00000000052E0000-0x0000000005372000-memory.dmp

Filesize
584KB

Download
memory/492-4-0x0000000005260000-0x0000000005270000-memory.dmp

Filesize
64KB

Download
memory/492-5-0x00000000052C0000-0x00000000052CA000-memory.dmp

Filesize
40KB

Download
memory/492-25-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/492-7-0x0000000005970000-0x000000000597A000-memory.dmp

Filesize
40KB

Download
memory/492-8-0x0000000007FE0000-0x0000000007FEE000-memory.dmp

Filesize
56KB

Download
memory/492-9-0x0000000008020000-0x00000000080AC000-memory.dmp

Filesize
560KB

Download
memory/492-10-0x000000000A800000-0x000000000A89C000-memory.dmp

Filesize
624KB

Download
memory/492-1-0x00000000007B0000-0x00000000008B2000-memory.dmp

Filesize
1.0MB

Download
memory/492-2-0x0000000005980000-0x0000000005F24000-memory.dmp

Filesize
5.6MB

Download
memory/492-0-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/4400-55-0x0000000006720000-0x000000000673E000-memory.dmp

Filesize
120KB

Download
memory/4400-58-0x0000000007470000-0x000000000748A000-memory.dmp

Filesize
104KB

Download
memory/4400-20-0x0000000005240000-0x0000000005868000-memory.dmp

Filesize
6.2MB

Download
memory/4400-68-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/4400-18-0x0000000002820000-0x0000000002830000-memory.dmp

Filesize
64KB

Download
memory/4400-24-0x00000000058E0000-0x0000000005946000-memory.dmp

Filesize
408KB

Download
memory/4400-23-0x0000000005170000-0x0000000005192000-memory.dmp

Filesize
136KB

Download
memory/4400-27-0x0000000005B00000-0x0000000005B66000-memory.dmp

Filesize
408KB

Download
memory/4400-65-0x0000000007710000-0x0000000007718000-memory.dmp

Filesize
32KB

Download
memory/4400-17-0x0000000074F90000-0x0000000075740000-memory.dmp

Filesize
7.7MB

Download
memory/4400-37-0x0000000005B70000-0x0000000005EC4000-memory.dmp

Filesize
3.3MB

Download
memory/4400-38-0x0000000006170000-0x000000000618E000-memory.dmp

Filesize
120KB

Download
memory/4400-39-0x0000000006200000-0x000000000624C000-memory.dmp

Filesize
304KB

Download
memory/4400-64-0x00000000077D0000-0x00000000077EA000-memory.dmp

Filesize
104KB

Download
memory/4400-63-0x00000000076D0000-0x00000000076E4000-memory.dmp

Filesize
80KB

Download
memory/4400-42-0x0000000002820000-0x0000000002830000-memory.dmp

Filesize
64KB

Download
memory/4400-43-0x000000007EF90000-0x000000007EFA0000-memory.dmp

Filesize
64KB

Download
memory/4400-44-0x0000000006740000-0x0000000006772000-memory.dmp

Filesize
200KB

Download
memory/4400-45-0x0000000075820000-0x000000007586C000-memory.dmp

Filesize
304KB

Download
memory/4400-15-0x0000000002830000-0x0000000002866000-memory.dmp

Filesize
216KB

Download
memory/4400-56-0x0000000007360000-0x0000000007403000-memory.dmp

Filesize
652KB

Download
memory/4400-57-0x0000000007AC0000-0x000000000813A000-memory.dmp

Filesize
6.5MB

Download
memory/4400-19-0x0000000002820000-0x0000000002830000-memory.dmp

Filesize
64KB

Download
memory/4400-59-0x00000000074E0000-0x00000000074EA000-memory.dmp

Filesize
40KB

Download
memory/4400-60-0x0000000007730000-0x00000000077C6000-memory.dmp

Filesize
600KB

Download
memory/4400-61-0x0000000007690000-0x00000000076A1000-memory.dmp

Filesize
68KB

Download
memory/4400-62-0x00000000076C0000-0x00000000076CE000-memory.dmp

Filesize
56KB

Download
memory/4600-41-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4600-40-0x00000000014F0000-0x000000000183A000-memory.dmp

Filesize
3.3MB

Download
memory/4600-26-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download
memory/4600-21-0x0000000000400000-0x000000000043F000-memory.dmp

Filesize
252KB

Download