e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c

Resubmissions

17/04/2024, 12:24

240417-pljenaef838

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

17/04/2024, 12:24

16/04/2024, 14:05

Analysis

max time kernel
153s
max time network
159s
platform
windows10-2004_x64
resource
win10v2004-20240226-en
resource tags

arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system
submitted
17/04/2024, 12:24

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Size 5.3MB
Sample240417-plcbcaef68
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
Key value queried	\REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\Control Panel\International\Geo\Nation	svchost.exe

Executes dropped EXE 1 IoCs

pid	Process
4716	svchost.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\xxx1.bak	svchost.exe
File created	C:\Windows\System\xxx1.bak	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
File created	C:\Windows\System\svchost.exe	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
1844	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
3292	powershell.exe
3292	powershell.exe
3188	powershell.exe
3188	powershell.exe
3188	powershell.exe
3292	powershell.exe
3696	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
3696	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
2412	powershell.exe
2412	powershell.exe
4544	powershell.exe
4544	powershell.exe
2412	powershell.exe
4544	powershell.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	3292	powershell.exe
Token: SeDebugPrivilege	3188	powershell.exe
Token: SeDebugPrivilege	2412	powershell.exe
Token: SeDebugPrivilege	4544	powershell.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3696 wrote to memory of 3188	3696	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	98
PID 3696 wrote to memory of 3188	3696	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	98
PID 3696 wrote to memory of 3292	3696	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	99
PID 3696 wrote to memory of 3292	3696	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	99
PID 3696 wrote to memory of 1844	3696	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	102
PID 3696 wrote to memory of 1844	3696	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	102
PID 3696 wrote to memory of 4716	3696	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	104
PID 3696 wrote to memory of 4716	3696	e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe	104
PID 4716 wrote to memory of 4544	4716	svchost.exe	107
PID 4716 wrote to memory of 4544	4716	svchost.exe	107
PID 4716 wrote to memory of 2412	4716	svchost.exe	109
PID 4716 wrote to memory of 2412	4716	svchost.exe	109

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe
"C:\Users\Admin\AppData\Local\Temp\e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3696
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3188
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3292
- C:\Windows\SYSTEM32\schtasks.exe
  schtasks /create /sc minute /ED "11/02/2024" /mo 7 /tn "Timer" /tr c:\windows\system\svchost.exe /ru SYSTEM
  2⤵
  - Creates scheduled task(s)
  PID:1844
- C:\Windows\System\svchost.exe
  "C:\Windows\System\svchost.exe" formal
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:4716
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath c:\windows\
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:4544
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath \\?\C:\Windows \
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:2412

C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe
"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=3768 --field-trial-handle=3088,i,14310325015283915034,7660943942870463106,262144 --variations-seed-version /prefetch:8
1⤵
PID:772

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Scheduled Task/Job

T1053

Privilege Escalation

Scheduled Task/Job

T1053

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

powershell.exe.log

Path C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
Size 2KB
SHA256 84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f
MD5 d85ba6ff808d9e5444a4b369f5bc2730
SHA1 31aa9d96590fff6981b315e0b391b575e4c0804a
SHA512 8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 a31805264b8b13ce4145f272cb2830728c186c46e314b48514d636866217add5
MD5 5f0ddc7f3691c81ee14d17b419ba220d
SHA1 f0ef5fde8bab9d17c0b47137e014c91be888ee53
SHA512 2ce7c2a0833f581297c13dd88ccfcd36bf129d2b5d7718c52b1d67c97cbd8fc93abc085a040229a0fd712e880c690de7f6b996b0b47c46a091fabb7931be58d3
MD5 SHA1 SHA512

Submit Download

StartupProfileData-NonInteractive

Path C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Size 944B
SHA256 0c557845aab1da497bbff0e8fbe65cabf4cb2804b97ba8ae8c695a528af70870
MD5 83685d101174171875b4a603a6c2a35c
SHA1 37be24f7c4525e17fa18dbd004186be3a9209017
SHA512 005a97a8e07b1840abdcef86a7881fd9bdc8acbfdf3eafe1dceb6374060626d81d789e57d87ca4096a39e28d5cca00f8945edff0a747591691ae75873d2b3fb5
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_wgc4kyg1.mgv.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_wgc4kyg1.mgv.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

cached-microdesc-consensus.tmp

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdesc-consensus.tmp
Size 2.6MB
SHA256 b8ac5707fb24e123ee2bb53e97cfb166b3e86f1ee46b36bef7c41cf0f58047fd
MD5 8c29dca81612f559ac2e9aa5012896e4
SHA1 e7b504c8be6ae987ced54380dc2a34d03c613ef7
SHA512 7c910b5c97dc3f556d35c9b48dd5ea4c4b55827bb66b508347c63650ad744f3992280df808a187f06daede1895347c46787fd110ba2015f92a927ab1f650a98c
SSDEEP 12288:KhhhTnI3fHDnNkbO4uwpzjCHTWb0NF0R3CobPNJUSXg6YUSnQ5s:KEHjyr1QS0WzNBwQX5s
MD5 SHA1 SHA512 SSDEEP

Submit Download

cached-microdescs.new

Path C:\Users\Admin\AppData\Roaming\tor\cached-microdescs.new
Size 19.1MB
SHA256 59674d4d87c3dc783e270bf8c35e00b9ad892956408ad851e7cb4c62ec17f5c1
MD5 3c483fcd4616cd636cc1f73196494481
SHA1 24edba7c7453558454ce5f61784f0931702f713d
SHA512 d71f4813f80c94a00b48a50e28aef74a8db0939900e2e6971ffb8e591a362029a7e4ad45a6bac4cc3f29c3f4328bc5a5f3953843ddb345774844a389471f7ede
SSDEEP 24576:QLhhqYow6AbdSTXq96Hf5jVmWnYjk3x50QIOyDTfHO+7eLmZz7uC6DO/nnYLKDzL:uNZ70UIggjfXb6BRZaZcyrC
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\System\svchost.exe
Size 5.3MB
SHA256 e3dad60364611b65c7548d803f58479e95b7493385c31688b6b4b7c15df64b9c
MD5 2e9e23fa8bcd5a77540acf53fd9eb0cb
SHA1 d59c9734a57d44b70c576214333b1cc3dd19ccdc
SHA512 a40c6908bc3a8279e1fbffbe52a49374e780ec7eea29e89c8746ec58514de252b0cbf8f61332240be51a209205548443f68890ffa44590e6ab1cd543a1800112
SSDEEP 98304:lQXWMzCvX6rbPny4EsfdRokAV+tM+yf4K1lMJulKu4y3MDOJrzhmmyijh44FNbJv:lQXWPX6rvfdRogF9lI0yjm4koBX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2412-79-0x00007FFFD5BF0000-0x00007FFFD66B1000-memory.dmp

Download

memory/2412-75-0x0000020909BD0000-0x0000020909BE0000-memory.dmp

Download

memory/2412-76-0x0000020909BD0000-0x0000020909BE0000-memory.dmp

Download

memory/2412-73-0x00007FFFD5BF0000-0x00007FFFD66B1000-memory.dmp

Download

memory/3188-37-0x00007FFFD5D20000-0x00007FFFD67E1000-memory.dmp

Download

memory/3188-26-0x000001F90C040000-0x000001F90C050000-memory.dmp

Download

memory/3188-28-0x000001F90C040000-0x000001F90C050000-memory.dmp

Download

memory/3188-25-0x00007FFFD5D20000-0x00007FFFD67E1000-memory.dmp

Download

memory/3292-30-0x00000236A4300000-0x00000236A4310000-memory.dmp

Download

memory/3292-36-0x00007FFFD5D20000-0x00007FFFD67E1000-memory.dmp

Download

memory/3292-29-0x00000236A4300000-0x00000236A4310000-memory.dmp

Download

memory/3292-27-0x00000236A4300000-0x00000236A4310000-memory.dmp

Download

memory/3292-15-0x00007FFFD5D20000-0x00007FFFD67E1000-memory.dmp

Download

memory/3292-5-0x00000236A41F0000-0x00000236A4212000-memory.dmp

Download

memory/3696-0-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3696-4-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3696-47-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3696-2-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3696-1-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/3696-3-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4544-57-0x00007FFFD5BF0000-0x00007FFFD66B1000-memory.dmp

Download

memory/4544-78-0x000001A84CC90000-0x000001A84CCA0000-memory.dmp

Download

memory/4544-74-0x000001A84CC90000-0x000001A84CCA0000-memory.dmp

Download

memory/4544-67-0x000001A84CC90000-0x000001A84CCA0000-memory.dmp

Download

memory/4544-82-0x00007FFFD5BF0000-0x00007FFFD66B1000-memory.dmp

Download

memory/4716-83-0x000000000A550000-0x000000000AA4C000-memory.dmp

Download

memory/4716-51-0x0000000140000000-0x0000000140644400-memory.dmp

Download

memory/4716-50-0x0000000140000000-0x0000000140644400-memory.dmp

Download