Analysis
- max time kernel
150s - max time network
152s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system - submitted
15/02/2024, 10:15
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9da39e88fa0e1e5afc1306cc0a5790b2.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
9da39e88fa0e1e5afc1306cc0a5790b2.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 9da39e88fa0e1e5afc1306cc0a5790b2.exe
- Size 985KB
- Sample240215-l97wdaef85
- SHA256 4c66dc4794938240922aecf53453ca80dc62f2631250a3f4c1b2d19ca6417f7c
- MD5 9da39e88fa0e1e5afc1306cc0a5790b2
- SHA1 31c391c0c7dc1b49a7d2e64af55af4c7574ecbcf
- SHA512 77b0c081b3ec8f74efe1925d65ce7f8ea2301539783b2778c4b1a74c53f2eb9a4f45824134f7033fe9d14ff26c04e5e35792c83581ffcd94f00f8ae8f511f083
- SSDEEP 24576:+MOmUg9nZBRi4WEYhPATcKAaNyZkQrImWtaR:+FmLRMPeuZZWt
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\Control Panel\International\Geo\Nation 9da39e88fa0e1e5afc1306cc0a5790b2.exe - Executes dropped EXE 2 IoCs
pid Process 1800 svchost.exe 4764 svchost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Crack.exe" 9da39e88fa0e1e5afc1306cc0a5790b2.exe Set value (str) \REGISTRY\USER\S-1-5-21-983843758-932321429-1636175382-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\Crack.exe" 9da39e88fa0e1e5afc1306cc0a5790b2.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 3548 set thread context of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 1968 set thread context of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe - Suspicious use of AdjustPrivilegeToken 50 IoCs
description pid Process Token: SeDebugPrivilege 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe Token: SeIncreaseQuotaPrivilege 1800 svchost.exe Token: SeSecurityPrivilege 1800 svchost.exe Token: SeTakeOwnershipPrivilege 1800 svchost.exe Token: SeLoadDriverPrivilege 1800 svchost.exe Token: SeSystemProfilePrivilege 1800 svchost.exe Token: SeSystemtimePrivilege 1800 svchost.exe Token: SeProfSingleProcessPrivilege 1800 svchost.exe Token: SeIncBasePriorityPrivilege 1800 svchost.exe Token: SeCreatePagefilePrivilege 1800 svchost.exe Token: SeBackupPrivilege 1800 svchost.exe Token: SeRestorePrivilege 1800 svchost.exe Token: SeShutdownPrivilege 1800 svchost.exe Token: SeDebugPrivilege 1800 svchost.exe Token: SeSystemEnvironmentPrivilege 1800 svchost.exe Token: SeChangeNotifyPrivilege 1800 svchost.exe Token: SeRemoteShutdownPrivilege 1800 svchost.exe Token: SeUndockPrivilege 1800 svchost.exe Token: SeManageVolumePrivilege 1800 svchost.exe Token: SeImpersonatePrivilege 1800 svchost.exe Token: SeCreateGlobalPrivilege 1800 svchost.exe Token: 33 1800 svchost.exe Token: 34 1800 svchost.exe Token: 35 1800 svchost.exe Token: 36 1800 svchost.exe Token: SeDebugPrivilege 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe Token: SeIncreaseQuotaPrivilege 4764 svchost.exe Token: SeSecurityPrivilege 4764 svchost.exe Token: SeTakeOwnershipPrivilege 4764 svchost.exe Token: SeLoadDriverPrivilege 4764 svchost.exe Token: SeSystemProfilePrivilege 4764 svchost.exe Token: SeSystemtimePrivilege 4764 svchost.exe Token: SeProfSingleProcessPrivilege 4764 svchost.exe Token: SeIncBasePriorityPrivilege 4764 svchost.exe Token: SeCreatePagefilePrivilege 4764 svchost.exe Token: SeBackupPrivilege 4764 svchost.exe Token: SeRestorePrivilege 4764 svchost.exe Token: SeShutdownPrivilege 4764 svchost.exe Token: SeDebugPrivilege 4764 svchost.exe Token: SeSystemEnvironmentPrivilege 4764 svchost.exe Token: SeChangeNotifyPrivilege 4764 svchost.exe Token: SeRemoteShutdownPrivilege 4764 svchost.exe Token: SeUndockPrivilege 4764 svchost.exe Token: SeManageVolumePrivilege 4764 svchost.exe Token: SeImpersonatePrivilege 4764 svchost.exe Token: SeCreateGlobalPrivilege 4764 svchost.exe Token: 33 4764 svchost.exe Token: 34 4764 svchost.exe Token: 35 4764 svchost.exe Token: 36 4764 svchost.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1800 svchost.exe - Suspicious use of WriteProcessMemory 31 IoCs
description pid Process procid_target PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1800 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 82 PID 3548 wrote to memory of 1968 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 83 PID 3548 wrote to memory of 1968 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 83 PID 3548 wrote to memory of 1968 3548 9da39e88fa0e1e5afc1306cc0a5790b2.exe 83 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84 PID 1968 wrote to memory of 4764 1968 9da39e88fa0e1e5afc1306cc0a5790b2.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\9da39e88fa0e1e5afc1306cc0a5790b2.exe"C:\Users\Admin\AppData\Local\Temp\9da39e88fa0e1e5afc1306cc0a5790b2.exe"1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3548 -
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1800
-
-
C:\Users\Admin\AppData\Local\Temp\9da39e88fa0e1e5afc1306cc0a5790b2.exe"C:\Users\Admin\AppData\Local\Temp\9da39e88fa0e1e5afc1306cc0a5790b2.exe"2⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1968 -
C:\Users\Admin\AppData\Roaming\svchost.exeC:\Users\Admin\AppData\Roaming\svchost.exe3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:4764
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\svchost.exe
- Size 1KB
- SHA256 c0657322afdac0df459f3bc233ecf362838774a116ff8d82846914925d246e83
- MD5 3d9bb6f53646c6a96df819bdb471796a
- SHA1 46d2d340398594f5060373f81232b82211e32825
- SHA512 b6165a7be23878cf75a70745d87767041f5a413c2f27d51440974ef205e09e10789cdc540bb504cd4cb4b857ae7d16e935fce85f1a618dde8b1f44471b661873
- MD5 SHA1 SHA512