Analysis
-
max time kernel
151s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
19-03-2024 20:29
Static task
static1
Behavioral task
behavioral1
Sample
d70aff28f5214470d0304a937c0bf7a9.exe
Resource
win7-20240220-en
Behavioral task
behavioral2
Sample
d70aff28f5214470d0304a937c0bf7a9.exe
Resource
win10v2004-20240226-en
General
-
Target
d70aff28f5214470d0304a937c0bf7a9.exe
-
Size
647KB
-
MD5
d70aff28f5214470d0304a937c0bf7a9
-
SHA1
5cb1ef5c6839a60354fddc414a11cc41db2d31e8
-
SHA256
f8e15aed8f0dbb50430567161ad19fd6fb0554b49682ddb40c905ddb4d166f66
-
SHA512
43c3e2c43209a1c264a4eb80d9c0765677f19ec6b0888aa5e951cea977fe4d7e2714345413848c2ac21a35720945b2cb9fce0466069e3850e5d6689010b28e7c
-
SSDEEP
12288:9dzmboLo3Q4GWVFTMNDyq8W/sAhOBaKW5IcvBz1ZlF5UFGuookWvxV6hFgagP:91lch1FoNWtWkAWaNIMxvhKaA
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation d70aff28f5214470d0304a937c0bf7a9.exe Key value queried \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation d70aff28f5214470d0304a937c0bf7a9.exe -
Executes dropped EXE 1 IoCs
pid Process 3008 d70aff28f5214470d0304a937c0bf7a9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Office = "\\Microsoft Office Collection\\office365.exe" d70aff28f5214470d0304a937c0bf7a9.exe Set value (str) \REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Office = "C:\\Users\\Admin\\AppData\\Local\\Microsoft Office Collection\\office365.exe" d70aff28f5214470d0304a937c0bf7a9.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 Taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A Taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName Taskmgr.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 4236 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3008 d70aff28f5214470d0304a937c0bf7a9.exe 3008 d70aff28f5214470d0304a937c0bf7a9.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3008 d70aff28f5214470d0304a937c0bf7a9.exe 1144 Taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 3076 d70aff28f5214470d0304a937c0bf7a9.exe Token: SeDebugPrivilege 3008 d70aff28f5214470d0304a937c0bf7a9.exe Token: SeDebugPrivilege 1144 Taskmgr.exe Token: SeSystemProfilePrivilege 1144 Taskmgr.exe Token: SeCreateGlobalPrivilege 1144 Taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe 1144 Taskmgr.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3008 d70aff28f5214470d0304a937c0bf7a9.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 3076 wrote to memory of 3008 3076 d70aff28f5214470d0304a937c0bf7a9.exe 90 PID 3076 wrote to memory of 3008 3076 d70aff28f5214470d0304a937c0bf7a9.exe 90 PID 3076 wrote to memory of 3008 3076 d70aff28f5214470d0304a937c0bf7a9.exe 90 PID 3076 wrote to memory of 1580 3076 d70aff28f5214470d0304a937c0bf7a9.exe 91 PID 3076 wrote to memory of 1580 3076 d70aff28f5214470d0304a937c0bf7a9.exe 91 PID 3076 wrote to memory of 1580 3076 d70aff28f5214470d0304a937c0bf7a9.exe 91 PID 1580 wrote to memory of 4236 1580 cmd.exe 93 PID 1580 wrote to memory of 4236 1580 cmd.exe 93 PID 1580 wrote to memory of 4236 1580 cmd.exe 93 PID 3008 wrote to memory of 1144 3008 d70aff28f5214470d0304a937c0bf7a9.exe 94 PID 3008 wrote to memory of 1144 3008 d70aff28f5214470d0304a937c0bf7a9.exe 94 PID 3008 wrote to memory of 1144 3008 d70aff28f5214470d0304a937c0bf7a9.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9.exe"C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9.exe"1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3076 -
C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9\d70aff28f5214470d0304a937c0bf7a9.exe"C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9\d70aff28f5214470d0304a937c0bf7a9.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3008 -
C:\Windows\SysWOW64\Taskmgr.exe"C:\Windows\System32\Taskmgr.exe"3⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1144
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 1.1.1.1 -n 1 -w 1000 > Nul & Del "C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1580 -
C:\Windows\SysWOW64\PING.EXEping 1.1.1.1 -n 1 -w 10003⤵
- Runs ping.exe
PID:4236
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\d70aff28f5214470d0304a937c0bf7a9\d70aff28f5214470d0304a937c0bf7a9.exe
Filesize647KB
MD5d70aff28f5214470d0304a937c0bf7a9
SHA15cb1ef5c6839a60354fddc414a11cc41db2d31e8
SHA256f8e15aed8f0dbb50430567161ad19fd6fb0554b49682ddb40c905ddb4d166f66
SHA51243c3e2c43209a1c264a4eb80d9c0765677f19ec6b0888aa5e951cea977fe4d7e2714345413848c2ac21a35720945b2cb9fce0466069e3850e5d6689010b28e7c
-
Filesize
70B
MD58efaf0f5e37779d7e6bc815e51fd10a7
SHA1725071d4f33ec443738395a5d7b651711424df05
SHA25617b71f1c104f2d0830d27d0f8b502f39a319c95f303b6e23d6c3b9f364ae2413
SHA512200e2ebd49706df349c1e47abe0724f258c114586acb4f30e3fe5dde8aa5d7e3040cae0359262439d2566292794386cd463feb02dc2c81b6c74675cd8b738548