Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240221-en -
resource tags
-
submitted
26-02-2024 05:05
General
-
Target
9ae11d65b395971a284fc936690c5d1dfd035332321fba900dfa873c58243283.exe
-
Size
101KB
-
MD5
19046ffd0a7a3365ba8e5b464bba149b
-
SHA1
66ce137113ada0844a916252f0e456d06cf906c1
-
SHA256
9ae11d65b395971a284fc936690c5d1dfd035332321fba900dfa873c58243283
-
SHA512
639f852a4665bb80271f10e1c60e5fd6046c556aaaa5c6e9e5cbfb43552ce2d7d4d4df03c15d51ecd28f25845e71a1ee60dc49a6fd76a6b468abfb6e153a2fed
-
SSDEEP
3072:z2NFei6thiKp+Ag3Q5JMUXFKJUHL5typ2g4e2byJYN:uFjOg3Q511Km5omeS
Malware Config
Signatures
-
Detects LgoogLoader payload 1 IoCs
-
LgoogLoader
A downloader capable of dropping and executing other malware families.
-
UAC bypass 3 TTPs 1 IoCs
-
Windows security bypass 2 TTPs 2 IoCs
-
Contacts a large (5078) amount of remote hosts 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Detects Windows executables referencing non-Windows User-Agents 1 IoCs
-
Detects executables packed with or use KoiVM 1 IoCs
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
-
Windows security modification 2 TTPs 3 IoCs
-
Checks whether UAC is enabled 1 TTPs 2 IoCs
-
Creates a large amount of network flows 1 TTPs
This may indicate a network scan to discover remotely running services.
-
Suspicious use of SetThreadContext 1 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
-
Suspicious use of WriteProcessMemory 16 IoCs
-
System policy modification 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ae11d65b395971a284fc936690c5d1dfd035332321fba900dfa873c58243283.exe"C:\Users\Admin\AppData\Local\Temp\9ae11d65b395971a284fc936690c5d1dfd035332321fba900dfa873c58243283.exe"1⤵
- UAC bypass
- Windows security bypass
- Checks computer location settings
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\9ae11d65b395971a284fc936690c5d1dfd035332321fba900dfa873c58243283.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
3Disable or Modify Tools
3Modify Registry
4Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
112KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
592KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
64KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
136KB
-
Filesize
64KB
-
Filesize
10.8MB
-
Filesize
52KB
-
Filesize
36KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
252KB
-
Filesize
36KB