Analysis
-
max time kernel
130s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20240426-en -
resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system -
submitted
23-05-2024 01:13
Static task
static1
Behavioral task
behavioral1
Sample
26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe
Resource
win10v2004-20240426-en
General
-
Target
26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe
-
Size
1.0MB
-
MD5
9c45e536f5c88334f24cab2ab89ee21e
-
SHA1
586564ab3bd5ea6c329d91af2cb90c62593cc5f9
-
SHA256
26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852
-
SHA512
c4c2d7a3296e37e448b7d5580c97cde6af431cb07c3e8d18b6d1e0fab68e47662605e7fa44273eda7f2b81907bf3d7a01847ded03feacbd80355c0f69a51b2ef
-
SSDEEP
12288:7X1iui6yWSKxwk0elr2wuC4bTaOJKxK75xi817KsmExR+ZImobjP:BdSKxw3eYhC4naOhZQIHjP
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exedescription pid process target process PID 3676 set thread context of 3228 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe RegSvcs.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exepowershell.exepid process 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe 3580 powershell.exe 3580 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exepowershell.exedescription pid process Token: SeDebugPrivilege 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe Token: SeDebugPrivilege 3580 powershell.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exedescription pid process target process PID 3676 wrote to memory of 3580 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe powershell.exe PID 3676 wrote to memory of 3580 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe powershell.exe PID 3676 wrote to memory of 3688 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe schtasks.exe PID 3676 wrote to memory of 3688 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe schtasks.exe PID 3676 wrote to memory of 3228 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe RegSvcs.exe PID 3676 wrote to memory of 3228 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe RegSvcs.exe PID 3676 wrote to memory of 3228 3676 26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe RegSvcs.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe"C:\Users\Admin\AppData\Local\Temp\26519d3b87b0bce9cacd121c6837fdf4e91500b52c14735068bb495f04fe1852.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\KaCTPSocApHQCE.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\KaCTPSocApHQCE" /XML "C:\Users\Admin\AppData\Local\Temp\tmpB20A.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exeC:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe2⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_3var1ghl.tmc.ps1Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
C:\Users\Admin\AppData\Local\Temp\tmpB20A.tmpFilesize
1KB
MD586aff1f182d841d77cc2fe8934fc72d6
SHA1e45871c357f37861cf68f2031eed198bfdcf6e8e
SHA2564dd74910a2ae9fa185469e0776ae8dab1cf34543776bc5ec1d9da61ec454652c
SHA512b96be479fabe4b79dc5b8453b3dbd1c8ce01a7869e284eddcfcfe1bff00e75ac48ffdcc8ce6de2909fa778c24e340f4ed6fe6283e3ca20a30bd0f9c8eea03cc6
-
memory/3580-31-0x00007FF98D980000-0x00007FF98E441000-memory.dmpFilesize
10.8MB
-
memory/3580-28-0x00007FF98D980000-0x00007FF98E441000-memory.dmpFilesize
10.8MB
-
memory/3580-24-0x000001BE15D30000-0x000001BE15D52000-memory.dmpFilesize
136KB
-
memory/3580-15-0x00007FF98D980000-0x00007FF98E441000-memory.dmpFilesize
10.8MB
-
memory/3580-22-0x00007FF98D980000-0x00007FF98E441000-memory.dmpFilesize
10.8MB
-
memory/3676-5-0x0000000003700000-0x0000000003710000-memory.dmpFilesize
64KB
-
memory/3676-8-0x00007FF98D980000-0x00007FF98E441000-memory.dmpFilesize
10.8MB
-
memory/3676-7-0x00007FF98D983000-0x00007FF98D985000-memory.dmpFilesize
8KB
-
memory/3676-6-0x000000001D790000-0x000000001D810000-memory.dmpFilesize
512KB
-
memory/3676-21-0x00007FF98D980000-0x00007FF98E441000-memory.dmpFilesize
10.8MB
-
memory/3676-4-0x00000000036F0000-0x0000000003702000-memory.dmpFilesize
72KB
-
memory/3676-0-0x00007FF98D983000-0x00007FF98D985000-memory.dmpFilesize
8KB
-
memory/3676-3-0x00000000016A0000-0x00000000016BA000-memory.dmpFilesize
104KB
-
memory/3676-2-0x00007FF98D980000-0x00007FF98E441000-memory.dmpFilesize
10.8MB
-
memory/3676-1-0x0000000000B50000-0x0000000000C5E000-memory.dmpFilesize
1.1MB