de894dce10bfc232aea2d9fa74e16c298d22caf5931eafec5e6476d16c33d983

Analysis

max time kernel
90s
max time network
96s
platform
windows10-2004_x64
resource
win10v2004-20240412-en
resource tags

arch:x64arch:x86image:win10v2004-20240412-enlocale:en-usos:windows10-2004-x64system
submitted
18/04/2024, 15:36

Sharing

Reason

Machine shutdown: "{\"level\":\"info\",\"time\":\"2024-04-18T15:38:12Z\",\"message\":\"Dirty snapshot: /var/lib/sandbox/hatchvm/win10v2004-20240412-en/instance_19-dirty.qcow2\"}"

Report Analysis Logs

General

Target

Спецификация контракта Казахстан – Российская Федерация.exe
Size

517KB
MD5

a6b7d5f2bfefda4b0663a7ba6bbc041c
SHA1

c5f5c00c55140cdddd198c32e5639ab41c0166db
SHA256

fc682a6fc3ac615b76230f7d1418e9d1b0f325e8d4a23df978453d07c9ce5f43
SHA512

9df274c79609c787836563ce606b0c5b4aba8a8e00a27ffc6b98cc1a9e66dfb6d4f276f4495194cfe471661ce30138439bb96b46d6f2dedd82e1494078187bd3
SSDEEP

12288:fzA/ggggjiOW6Ype3OIo+X2zvysLOxwph8Ow+:U/ggggji56Ykq+XoysLMo8Ow+

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1826666146-2574340311-1877551059-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Startup key = "%Udbytterigst% -windowstyle minimized $Genopbygget=(Get-ItemProperty -Path 'HKCU:\\Kapitalvrdien\\').Nonoptical;%Udbytterigst% ($Genopbygget)"	reg.exe

Suspicious use of NtCreateThreadExHideFromDebugger 2 IoCs

pid	Process
4592	wab.exe
4592	wab.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2628	powershell.exe
4592	wab.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2628 set thread context of 4592	2628	powershell.exe	94

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies registry key 1 TTPs 1 IoCs

Modify Registry

T1112

pid	Process
1044	reg.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

pid	Process
2628	powershell.exe
2628	powershell.exe
2628	powershell.exe
2628	powershell.exe
2628	powershell.exe
2628	powershell.exe
2628	powershell.exe
2628	powershell.exe
2628	powershell.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2628	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2628	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
4592	wab.exe

Suspicious use of WriteProcessMemory 17 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2628	3020	Спецификация контракта Казахстан – Российская Федерация.exe	86
PID 3020 wrote to memory of 2628	3020	Спецификация контракта Казахстан – Российская Федерация.exe	86
PID 3020 wrote to memory of 2628	3020	Спецификация контракта Казахстан – Российская Федерация.exe	86
PID 2628 wrote to memory of 3588	2628	powershell.exe	90
PID 2628 wrote to memory of 3588	2628	powershell.exe	90
PID 2628 wrote to memory of 3588	2628	powershell.exe	90
PID 2628 wrote to memory of 4592	2628	powershell.exe	94
PID 2628 wrote to memory of 4592	2628	powershell.exe	94
PID 2628 wrote to memory of 4592	2628	powershell.exe	94
PID 2628 wrote to memory of 4592	2628	powershell.exe	94
PID 2628 wrote to memory of 4592	2628	powershell.exe	94
PID 4592 wrote to memory of 4112	4592	wab.exe	95
PID 4592 wrote to memory of 4112	4592	wab.exe	95
PID 4592 wrote to memory of 4112	4592	wab.exe	95
PID 4112 wrote to memory of 1044	4112	cmd.exe	97
PID 4112 wrote to memory of 1044	4112	cmd.exe	97
PID 4112 wrote to memory of 1044	4112	cmd.exe	97

C:\Users\Admin\AppData\Local\Temp\Спецификация контракта Казахстан – Российская Федерация.exe
"C:\Users\Admin\AppData\Local\Temp\Спецификация контракта Казахстан – Российская Федерация.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Deklasstrr=Get-Content 'C:\Users\Admin\AppData\Roaming\skabiose\slgtsarvens\prender\Fellator\Paletter\Lowbyte\Avanceringen157\Rekrt.Bal';$Tapetal=$Deklasstrr.SubString(7309,3);.$Tapetal($Deklasstrr)"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2628
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\system32\cmd.exe" /c "set /A 1^^0"
    3⤵
    PID:3588
- - C:\Program Files (x86)\windows mail\wab.exe
    "C:\Program Files (x86)\windows mail\wab.exe"
    3⤵
    - Suspicious use of NtCreateThreadExHideFromDebugger
    - Suspicious use of NtSetInformationThreadHideFromDebugger
    - Suspicious use of SetWindowsHookEx
    - Suspicious use of WriteProcessMemory
    PID:4592
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\System32\cmd.exe" /c REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Udbytterigst% -windowstyle minimized $Genopbygget=(Get-ItemProperty -Path 'HKCU:\Kapitalvrdien\').Nonoptical;%Udbytterigst% ($Genopbygget)"
      4⤵
      Suspicious use of WriteProcessMemory
      PID:4112
    - - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKCU\Software\Microsoft\Windows\CurrentVersion\Run /f /v "Startup key" /t REG_EXPAND_SZ /d "%Udbytterigst% -windowstyle minimized $Genopbygget=(Get-ItemProperty -Path 'HKCU:\Kapitalvrdien\').Nonoptical;%Udbytterigst% ($Genopbygget)"
        5⤵
        Adds Run key to start application
        Modifies registry key
        
        PID:1044

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_k21t505c.p5g.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Roaming\skabiose\slgtsarvens\prender\Fellator\Paletter\Lowbyte\Avanceringen157\Patentets.Pri204

Filesize
333KB

MD5
fe3b114b11116efde2078f4754e719a4

SHA1
a85b985689fd1866fe055a1b842b76248ad82a2e

SHA256
78083b10cd94d81830dbe5e5187c765c82f2d7f1a7c98b0debb87ac6689a8506

SHA512
bfcf02b0c4cda208002d9a8d3ebd4525c4fd64ef86d57f8bde16a577778c3d4cbe62a35be18db75b2d353746dc335b5179153bb8c1c817ab5b77f6aa151c5423

Download Submit
C:\Users\Admin\AppData\Roaming\skabiose\slgtsarvens\prender\Fellator\Paletter\Lowbyte\Avanceringen157\Rekrt.Bal

Filesize
56KB

MD5
2354362f1cb0a39baef7da6969832048

SHA1
ed2a3597370eea69ea017af285c99d1b60556a0c

SHA256
f5129323c012e960d4b1a619a95757cc81675275e4c795883004c54da5ed3bb2

SHA512
a09dbc69627bd42180fe9cf8fc7234798e30296de3a2b35a0c071e7507d9a63a5dc3f0873183a8bd93e929e05ea5d647323cf2905f4550cfb8cc5ee07353999a

Download Submit
memory/2628-6-0x00000000044E0000-0x0000000004516000-memory.dmp

Filesize
216KB

Download
memory/2628-7-0x00000000742D0000-0x0000000074A80000-memory.dmp

Filesize
7.7MB

Download
memory/2628-8-0x0000000004560000-0x0000000004570000-memory.dmp

Filesize
64KB

Download
memory/2628-9-0x0000000004BA0000-0x00000000051C8000-memory.dmp

Filesize
6.2MB

Download
memory/2628-10-0x0000000005230000-0x0000000005252000-memory.dmp

Filesize
136KB

Download
memory/2628-11-0x00000000053D0000-0x0000000005436000-memory.dmp

Filesize
408KB

Download
memory/2628-12-0x0000000005470000-0x00000000054D6000-memory.dmp

Filesize
408KB

Download
memory/2628-22-0x00000000054E0000-0x0000000005834000-memory.dmp

Filesize
3.3MB

Download
memory/2628-23-0x0000000005AE0000-0x0000000005AFE000-memory.dmp

Filesize
120KB

Download
memory/2628-24-0x0000000005B00000-0x0000000005B4C000-memory.dmp

Filesize
304KB

Download
memory/2628-25-0x0000000004560000-0x0000000004570000-memory.dmp

Filesize
64KB

Download
memory/2628-26-0x0000000006AE0000-0x0000000006B76000-memory.dmp

Filesize
600KB

Download
memory/2628-27-0x0000000005FF0000-0x000000000600A000-memory.dmp

Filesize
104KB

Download
memory/2628-28-0x0000000006050000-0x0000000006072000-memory.dmp

Filesize
136KB

Download
memory/2628-29-0x0000000007130000-0x00000000076D4000-memory.dmp

Filesize
5.6MB

Download
memory/2628-31-0x0000000007D60000-0x00000000083DA000-memory.dmp

Filesize
6.5MB

Download
memory/2628-33-0x0000000004560000-0x0000000004570000-memory.dmp

Filesize
64KB

Download
memory/2628-35-0x00000000070A0000-0x00000000070A4000-memory.dmp

Filesize
16KB

Download
memory/2628-36-0x00000000742D0000-0x0000000074A80000-memory.dmp

Filesize
7.7MB

Download
memory/2628-38-0x0000000004560000-0x0000000004570000-memory.dmp

Filesize
64KB

Download
memory/2628-39-0x0000000004560000-0x0000000004570000-memory.dmp

Filesize
64KB

Download
memory/2628-40-0x0000000004560000-0x0000000004570000-memory.dmp

Filesize
64KB

Download
memory/2628-41-0x0000000004560000-0x0000000004570000-memory.dmp

Filesize
64KB

Download
memory/2628-42-0x00000000083E0000-0x000000000DC81000-memory.dmp

Filesize
88.6MB

Download
memory/2628-43-0x0000000077D21000-0x0000000077E41000-memory.dmp

Filesize
1.1MB

Download
memory/2628-58-0x00000000742D0000-0x0000000074A80000-memory.dmp

Filesize
7.7MB

Download
memory/4592-44-0x0000000077DA8000-0x0000000077DA9000-memory.dmp

Filesize
4KB

Download
memory/4592-45-0x0000000077D21000-0x0000000077E41000-memory.dmp

Filesize
1.1MB

Download
memory/4592-53-0x0000000077D21000-0x0000000077E41000-memory.dmp

Filesize
1.1MB

Download
memory/4592-54-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-55-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-52-0x0000000001BB0000-0x0000000007451000-memory.dmp

Filesize
88.6MB

Download
memory/4592-57-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-59-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-60-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-61-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-62-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-63-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-64-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-65-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-66-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-67-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-68-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-69-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-70-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-71-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-72-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-73-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-76-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-77-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-78-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-79-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-80-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-81-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-82-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-83-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-84-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-85-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-86-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-87-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-88-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-89-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-90-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-91-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-92-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download
memory/4592-93-0x0000000000950000-0x0000000001BA4000-memory.dmp

Filesize
18.3MB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads