f90622a62b327c6e24706d0523c70facd69386ebac78089be45acfc0c61ba026

Analysis

max time kernel
149s
max time network
161s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 22:55

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

82db606d3c1ed47c73a578c4f43f045c.exe
Size

71KB
MD5

82db606d3c1ed47c73a578c4f43f045c
SHA1

1d7ef55ceadb049b7a124724f513cdbdd3d9461c
SHA256

f90622a62b327c6e24706d0523c70facd69386ebac78089be45acfc0c61ba026
SHA512

d5e927310e8bfa344312db753faf33c30965df237d88ec8c3974a9676990ac402667a3266756acc0ccc6d9fc836d8c20fa87966040c1f1c742570445189801ad
SSDEEP

768:ZrItKyw5WHXfQmjIiIk9ecAx7pP1EPU96MyXPdtldE9bIIIwjk8:Zr3Z5IfQmv81x7pP1r3yXPdtnyj5

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
4456	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-557049126-2506969350-2798870634-1000\Control Panel\International\Geo\Nation	82db606d3c1ed47c73a578c4f43f045c.exe

Executes dropped EXE 1 IoCs

pid	Process
2912	cwshost.exe

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\cwshost.exe	82db606d3c1ed47c73a578c4f43f045c.exe
File opened for modification	C:\Windows\Debug\cwshost.exe	82db606d3c1ed47c73a578c4f43f045c.exe
File opened for modification	C:\Windows\Debug\cwshost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0	cwshost.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	cwshost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	2220	82db606d3c1ed47c73a578c4f43f045c.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2220 wrote to memory of 4456	2220	82db606d3c1ed47c73a578c4f43f045c.exe	85
PID 2220 wrote to memory of 4456	2220	82db606d3c1ed47c73a578c4f43f045c.exe	85
PID 2220 wrote to memory of 4456	2220	82db606d3c1ed47c73a578c4f43f045c.exe	85
PID 2220 wrote to memory of 1684	2220	82db606d3c1ed47c73a578c4f43f045c.exe	91
PID 2220 wrote to memory of 1684	2220	82db606d3c1ed47c73a578c4f43f045c.exe	91
PID 2220 wrote to memory of 1684	2220	82db606d3c1ed47c73a578c4f43f045c.exe	91

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
4456	attrib.exe

C:\Users\Admin\AppData\Local\Temp\82db606d3c1ed47c73a578c4f43f045c.exe
"C:\Users\Admin\AppData\Local\Temp\82db606d3c1ed47c73a578c4f43f045c.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2220
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\cwshost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - Views/modifies file attributes
  PID:4456
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\82DB60~1.EXE > nul
  2⤵
  PID:1684

C:\Windows\Debug\cwshost.exe
C:\Windows\Debug\cwshost.exe
1⤵
- Executes dropped EXE
- Checks processor information in registry
PID:2912

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\cwshost.exe

Filesize
71KB

MD5
2931c350713d7601fb401be85d105ef5

SHA1
8305addb52a72ea29c37534f048283cf71b103d4

SHA256
1356136db57d81e980a6c929636cd86228ecbc6b2f52da55a7babb604203aa2e

SHA512
4590179b8efa884946ba18ce53ec7ae0aba0036a7a924c758f20a50757c5880db55c8eaca5004b14064050e1eb16c960496c3cf169a25276732575bfec5cbfc5

Download Submit
memory/2220-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2912-5-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2912-6-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads