Analysis
- max time kernel
190s - max time network
202s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
05/04/2024, 11:00
Behavioral task
behavioral1
Sample
2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe
- Size 145KB
- Sample240405-m38d1aaa9w
- SHA256 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46
- MD5 4e39dcfb9913e475f04927e71f38733a
- SHA1 5618cdd20144cf44ac0719bf917aac2ff882e41c
- SHA512 678581a15c404351c98bacb0b2aa432023e9335536fefda4fe6613d2ba7daada5fa7fbc52b37c9b1c4421c7b66be44f1a5162d45478671018f8120ebbfa483e0
- SSDEEP 3072:p6glyuxE4GsUPnliByocWepO+cDevjAEyYFEf:p6gDBGpvEByocWe0+oeENY
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\Control Panel\International\Geo\Nation 3B44.tmp - Deletes itself 1 IoCs
pid Process 5092 3B44.tmp - Executes dropped EXE 1 IoCs
pid Process 5092 3B44.tmp - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\desktop.ini 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 5092 3B44.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp 5092 3B44.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeDebugPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: 36 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeImpersonatePrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeIncBasePriorityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeIncreaseQuotaPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: 33 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeManageVolumePrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeProfSingleProcessPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeRestorePrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSystemProfilePrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeTakeOwnershipPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeShutdownPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeDebugPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeBackupPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe Token: SeSecurityPrivilege 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4292 wrote to memory of 5092 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 94 PID 4292 wrote to memory of 5092 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 94 PID 4292 wrote to memory of 5092 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 94 PID 4292 wrote to memory of 5092 4292 2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe 94 PID 5092 wrote to memory of 5068 5092 3B44.tmp 95 PID 5092 wrote to memory of 5068 5092 3B44.tmp 95 PID 5092 wrote to memory of 5068 5092 3B44.tmp 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe"C:\Users\Admin\AppData\Local\Temp\2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4292 -
C:\ProgramData\3B44.tmp"C:\ProgramData\3B44.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:5092 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\3B44.tmp >> NUL3⤵PID:5068
-
-
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1412
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-275798769-4264537674-1142822080-1000\CCCCCCCCCCC
- Size 129B
- SHA256 841e23c6b37dcce18ccea8f8d440f5ff92c47bcd0409a600f6e0d21066c6d957
- MD5 8ecf785ce937503cae5ab83ab55bf545
- SHA1 143616fc3b582a2b586c5f08b9324585ef144d68
- SHA512 91faf5de6b774a3a2e6d07d2fb24eb07c9d170afd305a7b45cb66d0956c6fc5e5b6a6e8f1870b2bdfe80ee2549542614e440216dde280ef61e3d1e97023a40b0
- MD5 SHA1 SHA512
- Path C:\ProgramData\3B44.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\2e83048c7ed1193f09ae8d293b42c105662828f2ab56a2fa1f81379ee250fc46.exe
- Size 145KB
- SHA256 fdff597c85834be1ad384d3857778e9210d9dd82249f87d96fcb548b3fa80ef5
- MD5 92773710edaa0c2a2cb2fda45d242e11
- SHA1 38b9a148a5f85032408cec4d281a367a6c91397c
- SHA512 fc17fe1662d4756f10c00e8e9c7ded96fbe24cb4976d6475f7b8756ab535242e4399639f1db8e3c061ea40a280254f67aa3af844ced25e2f18de39c2513cd59b
- SSDEEP 3072:CK6BWDsDT2yW2VFHZvT7LlEptHBxcCJ5/3K6BWDsDT2yW2VFHZvT7LlEptHBxcCm:3h2C+BAtHBlJ5/6h2C+BAtHBlJ5/6h2q
- MD5 SHA1 SHA512 SSDEEP
- Path C:\tnif8b1Sa.README.txt
- Size 350B
- SHA256 85b163be93481e99e3bb328d1a69b200616bdb0afa297ee5f9ee1ae546bdda9a
- MD5 c3f1f1406b76280a20beab76871189bc
- SHA1 b065841b3f5331712e6672ed22edc023393e667d
- SHA512 f7a64c57b19faa69d6825f74c175a50aa9da22e94e673d76429724a7ee5cfccdfe60f495b040ea2e97d8ab1ee26d898fd6ba7b6161425cce7d39c39fd57beb19
- MD5 SHA1 SHA512
- Path F:\$RECYCLE.BIN\S-1-5-21-275798769-4264537674-1142822080-1000\AAAAAAAAAAA
- Size 129B
- SHA256 ee62065663e9593d8da930c5135358046d0853947dc86080d5872eb3b7baafb3
- MD5 7cfcf9adbb50e9e7dd1a66d63d32c597
- SHA1 deaafab9f51ade0b039b0ea6f58ba6e6b972fc13
- SHA512 6bddaf6fc682c815977b299c2cff4f8db704ac964c62efdd3c2a2497d01a2759f988fad67b63b07dd2fa58d402ca275331191aeeb755fda56842dd207ae21d71
- MD5 SHA1 SHA512