760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b

Analysis

max time kernel
149s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 02:17

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe
Size

65KB
MD5

1287026808fe1bbd5c8a019bd9443260
SHA1

21e6a9be0ad115c22d87155314982e937f0ddb37
SHA256

760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b
SHA512

e5e4d617b5dba6e0a02382e62472f4027c0ed995e4d70de7adc095c796d7a8a672cf3e26af2f7521a23ce2bc8cdb1f0c779cd5c7434ecc55d21f838bfe89b867
SSDEEP

768:ZrItKyw5WHXfQIhIiIk9ecAaVPD96KyX6O:Zr3Z5IfQIR81ad5yX6O

Score

8^/10

evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3464 attrib.exe

pid	process
3464	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-2804150937-2146708401-419095071-1000\Control Panel\International\Geo\Nation	760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe

Executes dropped EXE 1 IoCs

Processes:

cwshost.exe

pid process

2080 cwshost.exe

pid	process
2080	cwshost.exe

Drops file in Windows directory 3 IoCs

Processes:

760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exeattrib.exe

description	ioc	process
File created	C:\Windows\Debug\cwshost.exe	760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe
File opened for modification	C:\Windows\Debug\cwshost.exe	760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe
File opened for modification	C:\Windows\Debug\cwshost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe

description pid process

Token: SeIncBasePriorityPrivilege 2452 760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe

description	pid	process
Token: SeIncBasePriorityPrivilege	2452	760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe

description	pid	process	target process
PID 2452 wrote to memory of 3464	2452	760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe	attrib.exe
PID 2452 wrote to memory of 3464	2452	760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe	attrib.exe
PID 2452 wrote to memory of 3464	2452	760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe	attrib.exe
PID 2452 wrote to memory of 2428	2452	760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe	cmd.exe
PID 2452 wrote to memory of 2428	2452	760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe	cmd.exe
PID 2452 wrote to memory of 2428	2452	760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe	cmd.exe

Views/modifies file attributes 1 TTPs 1 IoCs
evasion

Hidden Files and Directories
T1564.001

Processes:

attrib.exe

pid process

3464 attrib.exe

pid	process
3464	attrib.exe

C:\Users\Admin\AppData\Local\Temp\760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe
"C:\Users\Admin\AppData\Local\Temp\760b7d06426fdb139a735f0f9c0a7a43da619f7fa6d07ccc5af6610cb2cf755b.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2452

C:\Windows\SysWOW64\attrib.exe
attrib +a +s +h +r C:\Windows\Debug\cwshost.exe
2⤵
- Sets file to hidden
- Drops file in Windows directory
- Views/modifies file attributes
PID:3464

C:\Windows\SysWOW64\cmd.exe
"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\760B7D~1.EXE > nul
2⤵
PID:2428

C:\Windows\Debug\cwshost.exe
C:\Windows\Debug\cwshost.exe
1⤵
- Executes dropped EXE
PID:2080

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\debug\cwshost.exe
Filesize
65KB

MD5
c8542c206014fab3b2d1e5a8ebe07c46

SHA1
e1efe7ec11d9c54d64a45af4e9d5acb9178affa3

SHA256
f73c19637c7266438458cb032cc5ce872a7a7924de02d84715edae1e9cf67919

SHA512
c3cdc4bdc14d645a39e553a4c9a181019cd2f1f1c354658a6b7bab9aa841a1964575b0d3d62e38dd2f9ac968a7ded80f8794fc33213ed649ed18f458ced3955a

Download Submit
memory/2080-5-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2080-7-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2452-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2452-6-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download