863b68913ac806bdef51e42f5e9f1328e7e89d44f6d9ee0932fa31899e32be61

Analysis

max time kernel
148s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
11/03/2024, 02:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

bf982c03d7bd53fc8d226c663130804c.exe
Size

34KB
MD5

bf982c03d7bd53fc8d226c663130804c
SHA1

8c61be7ea615be3d706964d468f562a06b5ade44
SHA256

863b68913ac806bdef51e42f5e9f1328e7e89d44f6d9ee0932fa31899e32be61
SHA512

f9d7d70a67bc4d1caa2f427cfa3fed74ce4bdebc1d24c3775940bb55eccac783274b079d89d65365143092caf5f2ead3b737d59f15a0a76d416fc1e1da412978
SSDEEP

768:l1MO6kHpnF/v3OOKN4ntqgGqQcHUoGcsVpgcrZ9X3:DN1b3M4nQcZGlg29X

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	bf982c03d7bd53fc8d226c663130804c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "services.exe"	bf982c03d7bd53fc8d226c663130804c.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1497073144-2389943819-3385106915-1000\Control Panel\International\Geo\Nation	bf982c03d7bd53fc8d226c663130804c.exe

Executes dropped EXE 1 IoCs

pid	Process
2960	~e5756e0.tmp

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
224	taskkill.exe
3732	taskkill.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
4040	bf982c03d7bd53fc8d226c663130804c.exe
4040	bf982c03d7bd53fc8d226c663130804c.exe
4040	bf982c03d7bd53fc8d226c663130804c.exe
4040	bf982c03d7bd53fc8d226c663130804c.exe
4040	bf982c03d7bd53fc8d226c663130804c.exe
4040	bf982c03d7bd53fc8d226c663130804c.exe
4040	bf982c03d7bd53fc8d226c663130804c.exe
4040	bf982c03d7bd53fc8d226c663130804c.exe
2960	~e5756e0.tmp
2960	~e5756e0.tmp
2960	~e5756e0.tmp
2960	~e5756e0.tmp
2960	~e5756e0.tmp
2960	~e5756e0.tmp

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
640	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3732	taskkill.exe
Token: SeDebugPrivilege	224	taskkill.exe
Token: SeDebugPrivilege	4040	bf982c03d7bd53fc8d226c663130804c.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 4040 wrote to memory of 3732	4040	bf982c03d7bd53fc8d226c663130804c.exe	84
PID 4040 wrote to memory of 3732	4040	bf982c03d7bd53fc8d226c663130804c.exe	84
PID 4040 wrote to memory of 3732	4040	bf982c03d7bd53fc8d226c663130804c.exe	84
PID 4040 wrote to memory of 224	4040	bf982c03d7bd53fc8d226c663130804c.exe	87
PID 4040 wrote to memory of 224	4040	bf982c03d7bd53fc8d226c663130804c.exe	87
PID 4040 wrote to memory of 224	4040	bf982c03d7bd53fc8d226c663130804c.exe	87
PID 4040 wrote to memory of 2960	4040	bf982c03d7bd53fc8d226c663130804c.exe	96
PID 4040 wrote to memory of 2960	4040	bf982c03d7bd53fc8d226c663130804c.exe	96
PID 4040 wrote to memory of 2960	4040	bf982c03d7bd53fc8d226c663130804c.exe	96

C:\Users\Admin\AppData\Local\Temp\bf982c03d7bd53fc8d226c663130804c.exe
"C:\Users\Admin\AppData\Local\Temp\bf982c03d7bd53fc8d226c663130804c.exe"
1⤵
- Sets file execution options in registry
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4040
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im ekrn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:3732
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im egui.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:224
- C:\Users\Admin\AppData\Local\Temp\~e5756e0.tmp
  C:\Users\Admin\AppData\Local\Temp\~e5756e0.tmp
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2960

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~e5756e0.tmp

Filesize
6KB

MD5
2160060127cace2e74d51fad2705337d

SHA1
fe7147338fa3bdf00839f2104c0d81c4f36b4b2b

SHA256
ae32dc99701dcea97cd61e8a7a9060a93597130fcf2625a43c07e1192b40ecd2

SHA512
174d7e2334d97afffe7bcc1d17e365e7403d0df8758b3ae29e364f937d3feb6a0fa318a9e741055bb0f990fdd0c8c8c0f8fb76b885394f2ff7dedd0c7a7a8232

Download Submit