20c0e8522d9e6fe9d45784826521416b657baeefd6c3dde33d7526a8dc7fff2b | Triage

Resubmissions

12/04/2024, 15:05

240412-sgj26see2v 10

12/04/2024, 15:05

240412-sggl2see2s 10

12/04/2024, 15:05

240412-sgf1hsbe23 10

12/04/2024, 15:05

240412-sgbqssbd99 10

12/04/2024, 15:05

240412-sga49sbd98 10

09/04/2024, 07:59

240409-jvg1asab26 10

09/04/2024, 07:59

240409-jvgdrsdd5w 10

09/04/2024, 07:59

240409-jvfr8sdd5v 10

09/04/2024, 07:59

240409-jvfggadd5t 10

19/01/2024, 20:24

240119-y6y6aadfb5 10

Analysis

max time kernel
212s
max time network
301s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
09/04/2024, 07:59

Sharing

Report Analysis Logs

General

Target

tmp.exe
Size

5.9MB
MD5

bbe98cc2bf5ce0c0bb4fb74370e2af68
SHA1

6a363ce866e541105642c2b35e048998e2dfdfea
SHA256

20c0e8522d9e6fe9d45784826521416b657baeefd6c3dde33d7526a8dc7fff2b
SHA512

900b23e8095ff64fc7d8b5d169204733410734046d0be059e60fe88be32c09e578ac94bdb466f4eba8565d78685aec499cbbfcb1332f6d90626bbb999690b762
SSDEEP

98304:lIIuKCEdO96Xkmby531xv91EZJ9XARo00k3NPedyEhyeSDwlqGuLpnKriRkS8KRn:lTO96bby5jv91SFVkoyEhyeSuuLpyfjm

Score

8^/10

evasion

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 4 IoCs

Windows Service

Disable or Modify System Firewall

pid	Process
3696	netsh.exe
4240	netsh.exe
4972	netsh.exe
4040	netsh.exe

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

System Information Discovery

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	tmp.exe
Key value queried	\REGISTRY\USER\S-1-5-21-399997616-3400990511-967324271-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 3 IoCs

pid	Process
4280	dc.exe
1676	svchost.exe
2476	dc.exe

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	C:\Windows\System\xxx1.bak	tmp.exe
File opened for modification	C:\Windows\System\dc.exe	tmp.exe
File created	C:\Windows\System\svchost.exe	tmp.exe
File opened for modification	C:\Windows\System\svchost.exe	tmp.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File opened for modification	C:\Windows\System\dc.exe	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

Scheduled Task/Job

pid	Process
4248	schtasks.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
1172	powershell.exe
1172	powershell.exe
1976	powershell.exe
1976	powershell.exe
1172	powershell.exe
1976	powershell.exe
4280	dc.exe
4280	dc.exe
4000	tmp.exe
4000	tmp.exe
2960	powershell.exe
5080	powershell.exe
2960	powershell.exe
5080	powershell.exe
2476	dc.exe
2476	dc.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1172	powershell.exe
Token: SeDebugPrivilege	1976	powershell.exe
Token: SeDebugPrivilege	2960	powershell.exe
Token: SeDebugPrivilege	5080	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 4000 wrote to memory of 3696	4000	tmp.exe	96
PID 4000 wrote to memory of 3696	4000	tmp.exe	96
PID 4000 wrote to memory of 4240	4000	tmp.exe	98
PID 4000 wrote to memory of 4240	4000	tmp.exe	98
PID 4000 wrote to memory of 1172	4000	tmp.exe	100
PID 4000 wrote to memory of 1172	4000	tmp.exe	100
PID 4000 wrote to memory of 1976	4000	tmp.exe	102
PID 4000 wrote to memory of 1976	4000	tmp.exe	102
PID 4000 wrote to memory of 4280	4000	tmp.exe	104
PID 4000 wrote to memory of 4280	4000	tmp.exe	104
PID 4000 wrote to memory of 4280	4000	tmp.exe	104
PID 4000 wrote to memory of 532	4000	tmp.exe	106
PID 4000 wrote to memory of 532	4000	tmp.exe	106
PID 4000 wrote to memory of 4248	4000	tmp.exe	108
PID 4000 wrote to memory of 4248	4000	tmp.exe	108
PID 4000 wrote to memory of 1676	4000	tmp.exe	110
PID 4000 wrote to memory of 1676	4000	tmp.exe	110
PID 1676 wrote to memory of 4972	1676	svchost.exe	112
PID 1676 wrote to memory of 4972	1676	svchost.exe	112
PID 1676 wrote to memory of 4040	1676	svchost.exe	114
PID 1676 wrote to memory of 4040	1676	svchost.exe	114
PID 1676 wrote to memory of 2960	1676	svchost.exe	115
PID 1676 wrote to memory of 2960	1676	svchost.exe	115
PID 1676 wrote to memory of 5080	1676	svchost.exe	118
PID 1676 wrote to memory of 5080	1676	svchost.exe	118
PID 1676 wrote to memory of 2476	1676	svchost.exe	120
PID 1676 wrote to memory of 2476	1676	svchost.exe	120
PID 1676 wrote to memory of 2476	1676	svchost.exe	120

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\tmp.exe
"C:\Users\Admin\AppData\Local\Temp\tmp.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:4000
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:3696
- C:\Windows\System32\netsh.exe
  "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
  2⤵
  - Modifies Windows Firewall
  PID:4240
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1172
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1976
- C:\Windows\System\dc.exe
  "C:\Windows\System\dc.exe" /D
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:4280
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /delete /TN "Timer"
  2⤵
  PID:532
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:4248
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:1676
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=in action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4972
- - C:\Windows\System32\netsh.exe
    "C:\Windows\System32\netsh.exe" advfirewall firewall add rule name="SvcHostX" dir=out action=allow program="C:\Windows\System\svchost.exe" enable=yes
    3⤵
    - Modifies Windows Firewall
    PID:4040
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2960
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:5080
- - C:\Windows\System\dc.exe
    "C:\Windows\System\dc.exe" /D
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    PID:2476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

Persistence

Create or Modify System Process

Windows Service

Scheduled Task/Job

Privilege Escalation

Create or Modify System Process

Windows Service

Scheduled Task/Job

Defense Evasion

Impair Defenses

Disable or Modify System Firewall

Credential Access

Discovery

Query Registry

System Information Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
d85ba6ff808d9e5444a4b369f5bc2730

SHA1
31aa9d96590fff6981b315e0b391b575e4c0804a

SHA256
84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

SHA512
8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
d28a889fd956d5cb3accfbaf1143eb6f

SHA1
157ba54b365341f8ff06707d996b3635da8446f7

SHA256
21e5d7ccf80a293e6ba30ed728846ca19c929c52b96e2c8d34e27cd2234f1d45

SHA512
0b6d88deb9be85722e6a78d5886d49f2caf407a59e128d2b4ed74c1356f9928c40048a62731959f2460e9ff9d9feee311043d2a37abe3bb92c2b76a44281478c

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
944B

MD5
22310ad6749d8cc38284aa616efcd100

SHA1
440ef4a0a53bfa7c83fe84326a1dff4326dcb515

SHA256
55b1d8021c4eb4c3c0d75e3ed7a4eb30cd0123e3d69f32eeb596fe4ffec05abf

SHA512
2ef08e2ee15bb86695fe0c10533014ffed76ececc6e579d299d3365fafb7627f53e32e600bb6d872b9f58aca94f8cb7e1e94cdfd14777527f7f0aa019d9c6def

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_idtraqy0.mzu.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\dbgwkam

Filesize
108KB

MD5
07232b64be72593980cd952e8f85017e

SHA1
61dba57cc51f4501ace3520e2cf559d8e42e04d7

SHA256
ef342bcc3c938c2fa9b38bc84019d8dce94d018372f7d9c29a8ee7ff3f0fc3a8

SHA512
d5417f270e14fe3437c0d017e037117001377379475531b70f9d6840548dd830117fbf62c152c9af09f586bdf944edac330bc560cca4fa45105269319e7158cb

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp

Filesize
2.6MB

MD5
a7322c0ba805744c82137309ef062277

SHA1
a7e721160f91611ab399948951a5a5d514fde409

SHA256
c89a350f2a67be2729932bd4216a02d6b6217704c84a283e07012d442f6ccce5

SHA512
d087fe0866f89235d193a5e1de751b3b7601c53b92ecbd092a5ee238b191254130c8a61b48796e4de2f42d77644238e7613f1aa9be8435ffee023c9baeb4c7c5

Download Submit
C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new

Filesize
14.0MB

MD5
1008e1284d21063975a39b23cee57e1d

SHA1
749adcac563e56d0655368f9e374419a1f6eb52d

SHA256
bf1425ae44dd0e281b7476c675a20c6041b4e234b4bd1404155b5f6cf08c6c1f

SHA512
cc575f5bd4ed118d0125f7c6d970324ad46d7eb474cda4a1ec2750c2bd6427e9bae008305583c184d3aab11965169e517ecc1687307e32e76dfb8f9de3206a4b

Download Submit
C:\Windows\System\dc.exe

Filesize
763KB

MD5
0a50081a6cd37aea0945c91de91c5d97

SHA1
755309c6d9fa4cd13b6c867cde01cc1e0d415d00

SHA256
6606d759667fbdfaa46241db7ffb4839d2c47b88a20120446f41e916cad77d0b

SHA512
f0a4e9a3dc065df2182527b17077c822d4535db86bf61f5ee795ee469b15159560a8e81e60d3037f3de1bb38e92f0fc8a422c2656882650d699e2b96948f9846

Download Submit
C:\Windows\System\svchost.exe

Filesize
5.9MB

MD5
bbe98cc2bf5ce0c0bb4fb74370e2af68

SHA1
6a363ce866e541105642c2b35e048998e2dfdfea

SHA256
20c0e8522d9e6fe9d45784826521416b657baeefd6c3dde33d7526a8dc7fff2b

SHA512
900b23e8095ff64fc7d8b5d169204733410734046d0be059e60fe88be32c09e578ac94bdb466f4eba8565d78685aec499cbbfcb1332f6d90626bbb999690b762

Download Submit
memory/1172-25-0x000001AA7B280000-0x000001AA7B290000-memory.dmp

Filesize
64KB

Download
memory/1172-13-0x000001AA7B280000-0x000001AA7B290000-memory.dmp

Filesize
64KB

Download
memory/1172-31-0x00007FF864970000-0x00007FF865431000-memory.dmp

Filesize
10.8MB

Download
memory/1172-7-0x000001AA7DA50000-0x000001AA7DA72000-memory.dmp

Filesize
136KB

Download
memory/1172-12-0x00007FF864970000-0x00007FF865431000-memory.dmp

Filesize
10.8MB

Download
memory/1676-59-0x00000001406F2000-0x00000001406F3000-memory.dmp

Filesize
4KB

Download
memory/1676-108-0x0000000031F20000-0x0000000032402000-memory.dmp

Filesize
4.9MB

Download
memory/1976-32-0x00007FF864970000-0x00007FF865431000-memory.dmp

Filesize
10.8MB

Download
memory/1976-24-0x000001B8F1100000-0x000001B8F1110000-memory.dmp

Filesize
64KB

Download
memory/1976-23-0x00007FF864970000-0x00007FF865431000-memory.dmp

Filesize
10.8MB

Download
memory/2960-61-0x000002077F260000-0x000002077F270000-memory.dmp

Filesize
64KB

Download
memory/2960-86-0x00007FF864970000-0x00007FF865431000-memory.dmp

Filesize
10.8MB

Download
memory/2960-62-0x000002077F260000-0x000002077F270000-memory.dmp

Filesize
64KB

Download
memory/2960-60-0x00007FF864970000-0x00007FF865431000-memory.dmp

Filesize
10.8MB

Download
memory/4000-0-0x00000001406F2000-0x00000001406F3000-memory.dmp

Filesize
4KB

Download
memory/4000-1-0x0000000140001000-0x000000014002B000-memory.dmp

Filesize
168KB

Download
memory/5080-83-0x00000237FCC00000-0x00000237FCC10000-memory.dmp

Filesize
64KB

Download
memory/5080-84-0x00000237FCC00000-0x00000237FCC10000-memory.dmp

Filesize
64KB

Download
memory/5080-82-0x00007FF864970000-0x00007FF865431000-memory.dmp

Filesize
10.8MB

Download
memory/5080-89-0x00007FF864970000-0x00007FF865431000-memory.dmp

Filesize
10.8MB

Download