Analysis
- max time kernel
149s - max time network
151s - platform
windows10-2004_x64 - resource
win10v2004-20240412-en - resource tags
- submitted
22/04/2024, 15:21
General
- Target doc.exe
- Size 731KB
- Sample240422-sra71sch51
- SHA256 12c735086c6b7f4d3d160b4a98d901d264ccdaa6fd1b2117483e9d84abdbb15a
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
- Suspicious behavior: EnumeratesProcesses 17 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 24 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\doc.exe"C:\Users\Admin\AppData\Local\Temp\doc.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\doc.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\GtCUjXACefqAX.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\GtCUjXACefqAX" /XML "C:\Users\Admin\AppData\Local\Temp\tmp80E8.tmp"2⤵
- Creates scheduled task(s)
-
-
C:\Users\Admin\AppData\Local\Temp\doc.exe"C:\Users\Admin\AppData\Local\Temp\doc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\doc.exe"C:\Users\Admin\AppData\Local\Temp\doc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\doc.exe"C:\Users\Admin\AppData\Local\Temp\doc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\doc.exe"C:\Users\Admin\AppData\Local\Temp\doc.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\doc.exe"C:\Users\Admin\AppData\Local\Temp\doc.exe"2⤵
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
powershell.exe.log
StartupProfileData-NonInteractive
__PSScriptPolicyTest_niowb0hh.kek.ps1
tmp80E8.tmp
memory/3680-86-0x0000000007BA0000-0x0000000007BBA000-memory.dmp
memory/3680-52-0x0000000075350000-0x000000007539C000-memory.dmp
memory/3680-85-0x0000000007AA0000-0x0000000007AB4000-memory.dmp
memory/3680-83-0x0000000007A60000-0x0000000007A71000-memory.dmp
memory/3680-80-0x0000000007860000-0x000000000787A000-memory.dmp
memory/3680-75-0x0000000005240000-0x0000000005250000-memory.dmp
memory/3680-76-0x0000000007730000-0x00000000077D3000-memory.dmp
memory/3680-65-0x000000007F1E0000-0x000000007F1F0000-memory.dmp
memory/3680-63-0x0000000006AF0000-0x0000000006B0E000-memory.dmp
memory/3680-25-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/3680-46-0x0000000005F20000-0x0000000006274000-memory.dmp
memory/3680-87-0x0000000007B80000-0x0000000007B88000-memory.dmp
memory/3680-20-0x0000000005240000-0x0000000005250000-memory.dmp
memory/3680-21-0x0000000005240000-0x0000000005250000-memory.dmp
memory/3680-26-0x0000000005810000-0x0000000005876000-memory.dmp
memory/3680-27-0x0000000005EB0000-0x0000000005F16000-memory.dmp
memory/3680-93-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/4908-49-0x0000000005ED0000-0x0000000005EEE000-memory.dmp
memory/4908-53-0x000000007EE10000-0x000000007EE20000-memory.dmp
memory/4908-23-0x0000000004E10000-0x0000000004E32000-memory.dmp
memory/4908-19-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
memory/4908-18-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/4908-94-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/4908-84-0x0000000007430000-0x000000000743E000-memory.dmp
memory/4908-50-0x0000000005F20000-0x0000000005F6C000-memory.dmp
memory/4908-17-0x00000000050E0000-0x0000000005708000-memory.dmp
memory/4908-51-0x0000000006E60000-0x0000000006E92000-memory.dmp
memory/4908-16-0x00000000025C0000-0x00000000025F6000-memory.dmp
memory/4908-82-0x0000000007480000-0x0000000007516000-memory.dmp
memory/4908-81-0x0000000007270000-0x000000000727A000-memory.dmp
memory/4908-77-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
memory/4908-79-0x0000000007840000-0x0000000007EBA000-memory.dmp
memory/4908-22-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
memory/4908-64-0x0000000075350000-0x000000007539C000-memory.dmp
memory/4908-78-0x0000000004AA0000-0x0000000004AB0000-memory.dmp
memory/4952-6-0x00000000068A0000-0x0000000006942000-memory.dmp
memory/4952-8-0x0000000005A50000-0x0000000005A5E000-memory.dmp
memory/4952-10-0x0000000002F30000-0x0000000002FB6000-memory.dmp
memory/4952-11-0x000000000A430000-0x000000000A4CC000-memory.dmp
memory/4952-7-0x0000000005710000-0x0000000005728000-memory.dmp
memory/4952-0-0x0000000000AD0000-0x0000000000B8A000-memory.dmp
memory/4952-9-0x0000000005A60000-0x0000000005A74000-memory.dmp
memory/4952-5-0x0000000005590000-0x000000000559A000-memory.dmp
memory/4952-4-0x0000000005820000-0x0000000005830000-memory.dmp
memory/4952-48-0x0000000074AA0000-0x0000000075250000-memory.dmp
memory/4952-3-0x00000000055B0000-0x0000000005642000-memory.dmp
memory/4952-2-0x0000000005A80000-0x0000000006024000-memory.dmp
memory/4952-1-0x0000000074AA0000-0x0000000075250000-memory.dmp