Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
09/03/2024, 17:37
Static task
static1
Behavioral task
behavioral1
Sample
027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral3
Sample
$PLUGINSDIR/inst.exe
Resource
win7-20231129-en
Behavioral task
behavioral4
Sample
$PLUGINSDIR/inst.exe
Resource
win10v2004-20240226-en
Behavioral task
behavioral5
Sample
$PLUGINSDIR/nsExec.dll
Resource
win7-20240221-en
Behavioral task
behavioral6
Sample
$PLUGINSDIR/nsExec.dll
Resource
win10v2004-20240226-en
General
-
Target
027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20.exe
-
Size
199KB
-
MD5
310020d11dca5daa292c6d121ce044e0
-
SHA1
974b85852d942d4bcf7fba23fc417d9083c1fb7d
-
SHA256
027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20
-
SHA512
39e7f13bb2a2e17f3a7e057a11567e1f70494181a08fe7d0847917677b8a4320c74105666b007bd25f697a739dc244fa12d2aac10e4ad0ce99597d01e3c729e7
-
SSDEEP
6144:FsaocyLCxJy0823optx30uY4OifzyHFuNn:FtobQy089tx3DYfGzyluNn
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation inst.exe -
Executes dropped EXE 2 IoCs
pid Process 4144 inst.exe 2244 4e9422ac-75a8-4a0f-9b5b-46785bc06f2f.exe -
Loads dropped DLL 1 IoCs
pid Process 4184 027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Windows\assembly\Desktop.ini inst.exe File opened for modification C:\Windows\assembly\Desktop.ini inst.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\assembly inst.exe File created C:\Windows\assembly\Desktop.ini inst.exe File opened for modification C:\Windows\assembly\Desktop.ini inst.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
description ioc Process Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8120f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce7f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030109000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b0601050507030153000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c06200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f1400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748501d00000001000000100000005b3b67000eeb80022e42605b6b3b72400b000000010000000e00000074006800610077007400650000007e000000010000000800000000c0032f2df8d60168000000010000000000000003000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b81190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d2000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 inst.exe Set value (data) \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81\Blob = 5c000000010000000400000000080000190000000100000010000000dc73f9b71e16d51d26527d32b11a6a3d03000000010000001400000091c6d6ee3e8ac86384e548c299295c756c817b816800000001000000000000007e000000010000000800000000c0032f2df8d6010b000000010000000e00000074006800610077007400650000001d00000001000000100000005b3b67000eeb80022e42605b6b3b72401400000001000000140000007b5b45cfafcecb7afd31921a6ab6f346eb5748506200000001000000200000008d722f81a9c113c0791df136a2966db26c950a971db46b4199f4ea54b78bfb9f53000000010000002500000030233021060b6086480186f8450107300130123010060a2b0601040182373c0101030200c009000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703017f000000010000002a000000302806082b0601050507030206082b0601050507030306082b0601050507030406082b060105050703010f000000010000001400000085fef11b4f47fe3952f98301c9f98976fefee0ce0400000001000000100000008ccadc0b22cef5be72ac411a11a8d8122000000001000000240400003082042030820308a0030201020210344ed55720d5edec49f42fce37db2b6d300d06092a864886f70d01010505003081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f74204341301e170d3036313131373030303030305a170d3336303731363233353935395a3081a9310b300906035504061302555331153013060355040a130c7468617774652c20496e632e31283026060355040b131f43657274696669636174696f6e205365727669636573204469766973696f6e31383036060355040b132f2863292032303036207468617774652c20496e632e202d20466f7220617574686f72697a656420757365206f6e6c79311f301d06035504031316746861777465205072696d61727920526f6f7420434130820122300d06092a864886f70d01010105000382010f003082010a0282010100aca0f0fb8059d49cc7a4cf9da159730910450c0d2c6e68f16c5b4868495937fc0b3319c2777fcc102d95341ce6eb4d09a71cd2b8c9973602b789d4245f06c0cc4494948d02626feb5add118d289a5c8490107a0dbd74662f6a38a0e2d55444eb1d079f07ba6feee9fd4e0b29f53e84a001f19cabf81c7e89a4e8a1d871650da3517beebcd222600db95b9ddfbafc515b0baf98b2e92ee904e86287de2bc8d74ec14c641eddcf8758ba4a4fca68071d1c9d4ac6d52f91cc7c71721cc5c067eb32fdc9925c94da85c09bbf537d2b09f48c9d911f976a52cbde0936a477d87b875044d53e6e2969fb3949261e09a5807b402debe82785c9fe61fd7ee67c971dd59d0203010001a3423040300f0603551d130101ff040530030101ff300e0603551d0f0101ff040403020106301d0603551d0e041604147b5b45cfafcecb7afd31921a6ab6f346eb574850300d06092a864886f70d010105050003820101007911c04bb391b6fcf0e967d40d6e45be55e893d2ce033fedda25b01d57cb1e3a76a04cec5076e864720ca4a9f1b88bd6d68784bb32e54111c077d9b3609deb1bd5d16e4444a9a601ec55621d77b85c8e48497c9c3b5711acad73378e2f785c906847d96060e6fc073d222017c4f716e9c4d872f9c8737cdf162f15a93efd6a27b6a1eb5aba981fd5e34d640a9d13c861baf5391c87bab8bd7b227ff6feac4079e5ac106f3d8f1b79768bc437b3211884e53600eb632099b9e9fe3304bb41c8c102f94463209e81ce42d3d63f2c76d3639c59dd8fa6e10ea02e41f72e9547cfbcfd33f3f60b617e7e912b8147c22730eea7105d378f5c392be404f07b8d568c68 inst.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\SystemCertificates\AuthRoot\Certificates\91C6D6EE3E8AC86384E548C299295C756C817B81 inst.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2244 4e9422ac-75a8-4a0f-9b5b-46785bc06f2f.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2244 4e9422ac-75a8-4a0f-9b5b-46785bc06f2f.exe 2244 4e9422ac-75a8-4a0f-9b5b-46785bc06f2f.exe -
Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 4184 wrote to memory of 4144 4184 027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20.exe 90 PID 4184 wrote to memory of 4144 4184 027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20.exe 90 PID 4144 wrote to memory of 2244 4144 inst.exe 94 PID 4144 wrote to memory of 2244 4144 inst.exe 94 PID 4144 wrote to memory of 2244 4144 inst.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20.exe"C:\Users\Admin\AppData\Local\Temp\027224e42ddba610a50c3bd948d8c81d824de1adc8d031808c6a65d3c291ac20.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Users\Admin\AppData\Local\Temp\nsd2973.tmp\inst.exeC:\Users\Admin\AppData\Local\Temp\nsd2973.tmp\inst.exe 4e9422ac-75a8-4a0f-9b5b-46785bc06f2f.exe /dT131491501S /e4813309 /t /u4e9422ac-75a8-4a0f-9b5b-46785bc06f2f2⤵
- Checks computer location settings
- Executes dropped EXE
- Drops desktop.ini file(s)
- Drops file in Windows directory
- Modifies system certificate store
- Suspicious use of WriteProcessMemory
PID:4144 -
C:\Users\Admin\AppData\Local\Temp\nsd2973.tmp\4e9422ac-75a8-4a0f-9b5b-46785bc06f2f.exe"C:\Users\Admin\AppData\Local\Temp\nsd2973.tmp\4e9422ac-75a8-4a0f-9b5b-46785bc06f2f.exe" /dT131491501S /e4813309 /t /u4e9422ac-75a8-4a0f-9b5b-46785bc06f2f3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2244
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\1F39B5CFACECFDE48DB25BCA2231FAC6_F0E2901B5CB9DFCB03318B8D06C40A30
Filesize1KB
MD53f4f56ba8e6d4467067ab67d38382af2
SHA1507bdd129d7e01a8b3f6da087454d4638283b7e9
SHA25624bcfb5601bfc7f9140013257df5767a2974e0f3182f7df060c026d3be21cc0f
SHA5123e2a37b61cbc1d7d28d8c6ef772098b523af071e870348e7e233d01ceee52de72ece9445cb622805b283dc19cacfe83ac6f8508711432e3dd473fed5d3b744f2
-
Filesize
604B
MD5a8c8eb8bf71ea727e35148b09b26fec7
SHA1f4ab4a15766b9d1e7253ecbb20973af8affbdb7c
SHA25621c9949032173647ca9cd7fd03822577e2eaeefa0954974f9dd8a9d7ed4c0e13
SHA512dc04414bf8dd78dafef8d5582ced4c8ab9e466354c03ddaa3014c1400934692a4dbabbf6200616e5364b4a69ce4192f283852a126c1e938a1705cd005d0c6d55
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\955CAB6FF6A24D5820D50B5BA1CF79C7_CC1689C2A9A5CB35265F3C2516751959
Filesize5B
MD54842e206e4cfff2954901467ad54169e
SHA180c9820ff2efe8aa3d361df7011ae6eee35ec4f0
SHA2562acab1228e8935d5dfdd1756b8a19698b6c8b786c90f87993ce9799a67a96e4e
SHA512ff537b1808fcb03cfb52f768fbd7e7bd66baf6a8558ee5b8f2a02f629e021aa88a1df7a8750bae1f04f3b9d86da56f0bdcba2fdbc81d366da6c97eb76ecb6cba
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\1F39B5CFACECFDE48DB25BCA2231FAC6_F0E2901B5CB9DFCB03318B8D06C40A30
Filesize412B
MD5f3753048ffe0e04070a6f1d764cf3551
SHA1f325ce21e0c376e82d0dc8e297e258e5ba86f256
SHA2567e4a4051b32edc4b1d18e8a63e31fee53a36c81bba00cf3f81eae3e291b48fe5
SHA512229346a06e51af258aec80b5823a19eb92f3103d25096ec6a0331dcac91a503f6bb40d9e309589978453b4935791bb06095706ea3f19014bfe7899694f0db4a4
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\8EDCF682921FE94F4A02A43CD1A28E6B
Filesize188B
MD59237a3311870d0f2fc8cf6d7b5848071
SHA1a47af01bcecc76e97d19d98f9a254ad88c25b8bf
SHA256751441b624efa3c5b931709dd9e48597f398dc16ae203cb017d081f42316327e
SHA512b85f86d8a2c44fcc3b0237b45c30f790ce057c0098d53d80e0d769560a6314e7b4a01afa8a7d40e4a545412037ad1145200d353d07fec94bde8ec82398a2ad50
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_AD9E7615297A3A83320AACE5801A04F9
Filesize404B
MD57099eb53879f2f70b32004ff5456923d
SHA178a7ce81f3da74cb7cc0db35e6e3bda45c1d313f
SHA2560cb3549f7c6128652c3ee82ca578c432fcdcf61466ba749dc1e80b247382f500
SHA512966ec059c611bc88f67aa4f18b30af8ab29acad40c200eba89ccc5060185221fd35dd9c1ba60d1939fc27a63e126ff7b6c1a7c16d67347a30e47119a7bdf8b78
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\955CAB6FF6A24D5820D50B5BA1CF79C7_CC1689C2A9A5CB35265F3C2516751959
Filesize482B
MD5af034f010120de24e324c6fe158f6aa8
SHA1fb11f24748f09797f91c51fd3a4ba241b248019b
SHA256cc6be2e18cda50e4f6414509da379456c5a84e9b8dfd0c1f6cd6c6b3f95acbbb
SHA51268370fc5efe11aa3d2f24be370de2b2dc444c13d81e789afbe9a539b0ac7f49ddc4d553fd27b7b9606f372c5e55d95e0f44e73203fbbdc5916a7287d9d4a4a13
-
Filesize
163KB
MD5c79eb4f84596b7e43f7800b158c034c4
SHA123c3184f55dc9dce991662f5fd38d95054930f56
SHA256a153b4705136b923cfc8fcf3fc7cee6539039f410abc99719ff5edb8ef3c23ec
SHA5125f5eeeb35ecfc95fdf306c2e984ffc0c610c295b3e35fdd9f87d6f03362210e66155910aa16c31ef35162a39a536ee9e0c57463f3d5081e2185e905e9cd759a9
-
Filesize
143KB
MD50f9c02df96da8a059c83ddfcfc0f8c6a
SHA12a3fa9056603c843a4c086136557c4ad9cd190c3
SHA25656099fbbb997f4fdee7bcb8fabe62f3d49273028bcee7f12018e6c18b54af455
SHA5121481ca881e19074da73a46009d35d12e4221ec6f8c9aefe007a0a9d12d52eef4db6c5a38dfda18922d0fffd519c15032997df1df7c79f93361650f91476bbe7b
-
Filesize
8KB
MD5249ae678f0dac4c625c6de6aca53823a
SHA16ac2b9e90e8445fed4c45c5dbf2d0227cd3b5201
SHA2567298024a36310b7c4c112be87b61b62a0b1be493e2d5252a19e5e976daf674ce
SHA51266e4081a40f3191bf28b810cf8411cb3c8c3e3ec5943e18d6672414fb5e7b4364f862cba44c9115c599ac90890ef02a773e254e7c979e930946bc52b0693aad7