Analysis
-
max time kernel
139s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
17-02-2024 20:38
Static task
static1
Behavioral task
behavioral1
Sample
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe
Resource
win10v2004-20231215-en
General
-
Target
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe
-
Size
43KB
-
MD5
ed3326070afd94f87cdaf84b73e6e9ef
-
SHA1
672a4894dbfccee529479f48b72a5d9387bf4e80
-
SHA256
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e
-
SHA512
e50daaa2e312bf1f58aa75009b963570f8bb7839606a05a344cebaa28485789804f3014f7bbbe56f96a89fb148a1dc8a5adb70a1fea5ab7f2bcabd10a6b24948
-
SSDEEP
768:+zQLbMYi+I2XsS35xRGUZjsosoTwoM1LmelYdX/1QXcmYZllsXEFiRNi:+zQEYiZ2cS35xRGUaosoMoM17lY91QMb
Malware Config
Signatures
-
Detects LgoogLoader payload 2 IoCs
Processes:
resource yara_rule behavioral2/memory/380-22-0x0000000002A90000-0x0000000002A9D000-memory.dmp family_lgoogloader behavioral2/memory/380-21-0x0000000002A90000-0x0000000002A9D000-memory.dmp family_lgoogloader -
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
Processes:
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe -
Processes:
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe = "0" eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3073191680-435865314-2862784915-1000\Control Panel\International\Geo\Nation eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe -
Processes:
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Exclusions\Paths\C:\Users\Admin\AppData\Local\Temp\eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe = "0" eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe -
Processes:
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exedescription pid process target process PID 4504 set thread context of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 3456 powershell.exe 3456 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exepowershell.exedescription pid process Token: SeDebugPrivilege 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe Token: SeDebugPrivilege 3456 powershell.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exedescription pid process target process PID 4504 wrote to memory of 3456 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe powershell.exe PID 4504 wrote to memory of 3456 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe powershell.exe PID 4504 wrote to memory of 3456 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe powershell.exe PID 4504 wrote to memory of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe PID 4504 wrote to memory of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe PID 4504 wrote to memory of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe PID 4504 wrote to memory of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe PID 4504 wrote to memory of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe PID 4504 wrote to memory of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe PID 4504 wrote to memory of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe PID 4504 wrote to memory of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe PID 4504 wrote to memory of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe PID 4504 wrote to memory of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe PID 4504 wrote to memory of 380 4504 eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe calc.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe"C:\Users\Admin\AppData\Local\Temp\eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\eb76472cb7a072bbfb59918ef1594ca866fbd9884b2776cb5e427dcec2d3b13e.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SYSWOW64\calc.exe"2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_rqczj2xw.bn0.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
memory/380-12-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/380-21-0x0000000002A90000-0x0000000002A9D000-memory.dmpFilesize
52KB
-
memory/380-22-0x0000000002A90000-0x0000000002A9D000-memory.dmpFilesize
52KB
-
memory/380-17-0x0000000002A60000-0x0000000002A69000-memory.dmpFilesize
36KB
-
memory/380-15-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/380-13-0x0000000000400000-0x000000000043D000-memory.dmpFilesize
244KB
-
memory/3456-20-0x0000000006070000-0x00000000060D6000-memory.dmpFilesize
408KB
-
memory/3456-50-0x0000000007A00000-0x0000000007A1A000-memory.dmpFilesize
104KB
-
memory/3456-9-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/3456-10-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/3456-11-0x0000000005960000-0x0000000005F88000-memory.dmpFilesize
6.2MB
-
memory/3456-7-0x0000000002D20000-0x0000000002D56000-memory.dmpFilesize
216KB
-
memory/3456-61-0x0000000075010000-0x00000000757C0000-memory.dmpFilesize
7.7MB
-
memory/3456-58-0x0000000075010000-0x00000000757C0000-memory.dmpFilesize
7.7MB
-
memory/3456-57-0x0000000007D20000-0x0000000007D28000-memory.dmpFilesize
32KB
-
memory/3456-56-0x0000000007D40000-0x0000000007D5A000-memory.dmpFilesize
104KB
-
memory/3456-18-0x0000000005710000-0x0000000005732000-memory.dmpFilesize
136KB
-
memory/3456-19-0x0000000006000000-0x0000000006066000-memory.dmpFilesize
408KB
-
memory/3456-55-0x0000000007C40000-0x0000000007C54000-memory.dmpFilesize
80KB
-
memory/3456-54-0x0000000007C30000-0x0000000007C3E000-memory.dmpFilesize
56KB
-
memory/3456-53-0x0000000007C00000-0x0000000007C11000-memory.dmpFilesize
68KB
-
memory/3456-52-0x0000000007C80000-0x0000000007D16000-memory.dmpFilesize
600KB
-
memory/3456-28-0x00000000060E0000-0x0000000006434000-memory.dmpFilesize
3.3MB
-
memory/3456-33-0x00000000066F0000-0x000000000670E000-memory.dmpFilesize
120KB
-
memory/3456-34-0x0000000006710000-0x000000000675C000-memory.dmpFilesize
304KB
-
memory/3456-35-0x0000000005320000-0x0000000005330000-memory.dmpFilesize
64KB
-
memory/3456-36-0x00000000076F0000-0x0000000007722000-memory.dmpFilesize
200KB
-
memory/3456-37-0x0000000071F40000-0x0000000071F8C000-memory.dmpFilesize
304KB
-
memory/3456-47-0x0000000006CB0000-0x0000000006CCE000-memory.dmpFilesize
120KB
-
memory/3456-48-0x0000000007930000-0x00000000079D3000-memory.dmpFilesize
652KB
-
memory/3456-49-0x0000000008060000-0x00000000086DA000-memory.dmpFilesize
6.5MB
-
memory/3456-8-0x0000000075010000-0x00000000757C0000-memory.dmpFilesize
7.7MB
-
memory/3456-51-0x0000000007A70000-0x0000000007A7A000-memory.dmpFilesize
40KB
-
memory/4504-1-0x0000000000AA0000-0x0000000000AB0000-memory.dmpFilesize
64KB
-
memory/4504-2-0x0000000003050000-0x000000000306A000-memory.dmpFilesize
104KB
-
memory/4504-0-0x0000000075010000-0x00000000757C0000-memory.dmpFilesize
7.7MB
-
memory/4504-3-0x00000000055A0000-0x00000000055B0000-memory.dmpFilesize
64KB
-
memory/4504-4-0x00000000060F0000-0x000000000618C000-memory.dmpFilesize
624KB
-
memory/4504-16-0x0000000075010000-0x00000000757C0000-memory.dmpFilesize
7.7MB
-
memory/4504-5-0x0000000006050000-0x00000000060B8000-memory.dmpFilesize
416KB
-
memory/4504-6-0x0000000006740000-0x0000000006CE4000-memory.dmpFilesize
5.6MB