01be832152327cf39ccb91a99c630d1ac48bca0306a2ab5cb48349c555a6ef3d

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
23-05-2024 11:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

X22-74224.exe
Size

3.7MB
MD5

133800da193dac14b538577b2a5f39d0
SHA1

7135c3dd93c43d9d323c16f4323eeaa28c415f6f
SHA256

27a49064bae3fbe92df2738884079f2214865f8fa2b84d21229f05ac1868928f
SHA512

bcf9d3b3528f63370e6da6364b8fbfda6044f3a430d4a51501d9cfb1d5103e687bcb59bdceb163af331bcb429980396844cf26d29aeba89ed79813fefb83408b
SSDEEP

98304:DNM0iKxRMIm/Ly4RYXAffiiIiQLAUUuQNnn02nj:DVxRc/W4YwfKHiQZT2j

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000\Control Panel\International\Geo\Nation	setup.exe

Executes dropped EXE 1 IoCs

pid	Process
4980	setup.exe

Checks system information in the registry 2 TTPs 2 IoCs

System information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemManufacturer	setup.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SystemInformation\SystemProductName	setup.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
2400	powershell.exe
520	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	setup.exe

Enumerates system info in registry 2 TTPs 3 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily	setup.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	setup.exe

Modifies registry class 2 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\	X22-74224.exe
Key created	\REGISTRY\USER\S-1-5-21-3558294865-3673844354-2255444939-1000_Classes\WOW6432Node\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\	X22-74224.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
2400	powershell.exe
2400	powershell.exe
2400	powershell.exe
520	powershell.exe
520	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	powershell.exe
Token: SeDebugPrivilege	520	powershell.exe

Suspicious use of SetWindowsHookEx 21 IoCs

pid	Process
4980	setup.exe
2312	WORDPAD.EXE
2312	WORDPAD.EXE
2312	WORDPAD.EXE
2312	WORDPAD.EXE
2312	WORDPAD.EXE
2400	WORDPAD.EXE
2400	WORDPAD.EXE
2400	WORDPAD.EXE
2400	WORDPAD.EXE
2400	WORDPAD.EXE
5084	WORDPAD.EXE
5084	WORDPAD.EXE
5084	WORDPAD.EXE
5084	WORDPAD.EXE
5084	WORDPAD.EXE
3292	WORDPAD.EXE
3292	WORDPAD.EXE
3292	WORDPAD.EXE
3292	WORDPAD.EXE
3292	WORDPAD.EXE

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 4980 wrote to memory of 2400	4980	setup.exe	100
PID 4980 wrote to memory of 2400	4980	setup.exe	100
PID 4980 wrote to memory of 2400	4980	setup.exe	100
PID 4980 wrote to memory of 520	4980	setup.exe	103
PID 4980 wrote to memory of 520	4980	setup.exe	103
PID 4980 wrote to memory of 520	4980	setup.exe	103
PID 4628 wrote to memory of 2312	4628	MSOXMLED.EXE	106
PID 4628 wrote to memory of 2312	4628	MSOXMLED.EXE	106
PID 4284 wrote to memory of 2400	4284	MSOXMLED.EXE	114
PID 4284 wrote to memory of 2400	4284	MSOXMLED.EXE	114
PID 3032 wrote to memory of 5084	3032	MSOXMLED.EXE	116
PID 3032 wrote to memory of 5084	3032	MSOXMLED.EXE	116
PID 2764 wrote to memory of 3292	2764	MSOXMLED.EXE	118
PID 2764 wrote to memory of 3292	2764	MSOXMLED.EXE	118

C:\Users\Admin\AppData\Local\Temp\X22-74224.exe
"C:\Users\Admin\AppData\Local\Temp\X22-74224.exe"
1⤵
- Modifies registry class
PID:4072

C:\Users\Admin\Desktop\setup.exe
"C:\Users\Admin\Desktop\setup.exe"
1⤵
- Checks computer location settings
- Executes dropped EXE
- Checks system information in the registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4980
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2400
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile "$package = Get-AppxPackage Microsoft.Office.Desktop -allUsers; if (!$package) { $Error.Add(\"Package is not installed\")}; if ($error.Count -eq 0) { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '1' -Encoding ascii; } else { Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch' -InputObject '0' -Encoding ascii; Out-File -FilePath 'C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch' -InputObject $error -Encoding ascii;} "
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:520

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb edit "C:\Users\Admin\Desktop\configuration-Office365-x64.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4628
- C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
  "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\configuration-Office365-x64.xml"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2312

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc
1⤵
PID:3040

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb edit "C:\Users\Admin\Desktop\configuration-Office365-x86.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:4284
- C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
  "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\configuration-Office365-x86.xml"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:2400

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb edit "C:\Users\Admin\Desktop\configuration-Office2019Enterprise.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
  "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\configuration-Office2019Enterprise.xml"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:5084

C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE
"C:\Program Files\Microsoft Office\Root\VFS\ProgramFilesCommonX64\Microsoft Shared\Office16\MSOXMLED.EXE" /verb edit "C:\Users\Admin\Desktop\configuration-Office2021Enterprise.xml"
1⤵
- Suspicious use of WriteProcessMemory
PID:2764
- C:\Program Files\Windows NT\Accessories\WORDPAD.EXE
  "C:\Program Files\Windows NT\Accessories\WORDPAD.EXE" "C:\Users\Admin\Desktop\configuration-Office2021Enterprise.xml"
  2⤵
  - Suspicious use of SetWindowsHookEx
  PID:3292

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
95201d9e44c732d9b261b4b334505d6b

SHA1
d5f3f499ef27920d8a614152191a7e0c2f9c0264

SHA256
baa9a89717f4013b2799bd06490c738246759ecdf7a3200406fad5a443e83669

SHA512
15ddf637b642144dca99e2794cb4ca4d1dfa9d682e7eb42075d9b269dd5a479b5ea86017db142b599a3f022ebb695baf3691305ab17009060b4f64ddd7254282

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
18KB

MD5
02882ad3f930ba7d577b570ce1e10d1a

SHA1
0f9d23f1fd9a759d7b5d85a4a94f9eaf5aed641e

SHA256
ccd03d7fca50dc0e35426131038879a59f8a6c102a7543237182e1281678bad7

SHA512
6e2d54a0501b793df66978cf27ca0c90b688d87cff0807ab90e351942d5893ac97739508b73edbfba257865219c29f8ca96adb3a60ad36e760932375519cf45f

Download Submit
C:\Users\Admin\AppData\Local\Temp\Office.ValidateError.scratch

Filesize
26B

MD5
bd3457e50947d4280734e74b51b5b68d

SHA1
424635c6b5622a6c01a59d290a1c9ab8e593effc

SHA256
23d647979bc5dc186de5ba3e00a222a912ab8e4782eb6407efa70e29e95979f5

SHA512
e83e3615a5e94af288eb1c9b92f55e271765cc43531ec94574371debf63c0c4a58327b6fd8a4775bfba8a3234220cb0396b6d33164309a09a1d826c0689143fb

Download Submit
C:\Users\Admin\AppData\Local\Temp\Office.ValidateResult.scratch

Filesize
3B

MD5
21438ef4b9ad4fc266b6129a2f60de29

SHA1
5eb8e2242eeb4f5432beeec8b873f1ab0a6b71fd

SHA256
13bf7b3039c63bf5a50491fa3cfd8eb4e699d1ba1436315aef9cbe5711530354

SHA512
37436ced85e5cd638973e716d6713257d692f9dd2e1975d5511ae3856a7b3b9f0d9e497315a058b516ab31d652ea9950938c77c1ad435ea8d4b49d73427d1237

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_105idm5u.wua.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\Desktop\configuration-Office2019Enterprise.xml

Filesize
1KB

MD5
f78234922b70d03b04d1c1e94cdeebbd

SHA1
cb83ade2e2158c4b72e8dd7bfeebf9dd666450d7

SHA256
d4913b9e6faf2a5cd7db5956a305af45767d6675b110df4b6e11827a692929d2

SHA512
222a831c6b91d99b104b2bef778eed909d78efeb4e1e099a11a4c047f0415806074b6fd2a87cc3ea4c16499a42e37b7f8c2d9566d2da07b6433f24e4698c58af

Download Submit
C:\Users\Admin\Desktop\configuration-Office2021Enterprise.xml

Filesize
1KB

MD5
315eea2acb2f3d5a9235ee5a6be4a164

SHA1
249ce4d4344326f2a23ebc0f9ee2119b5f896903

SHA256
923230d7e183f8f7f3e65e67df35fa163dd41624af58c53d793907ffb0c09b76

SHA512
05fea0eab49647031bcf772fbe7f87839a33aabbca84b6636574211d6847b86a9fcb7bdfbf325ae10f0278e4af92b0176d596ee6de378a1b804309bc027cbb21

Download Submit
C:\Users\Admin\Desktop\configuration-Office365-x64.xml

Filesize
1014B

MD5
544756964c06ed5dbf916041156d46d7

SHA1
d4711855a764ab3d415f1d4e0baaeefc1d12440b

SHA256
0f8008fdf8d54085c0e49d8424f3aae8886400ec52b6755233c642311839eef1

SHA512
8a9b5ec7dfe296f029e510ccb12f2df66a428622feb152f2eb4110111f2e75a472b1a8db9c69bec7f6dc61b8f7289ee7c5f4243f35f9ac85350b5d1303d5f6f6

Download Submit
C:\Users\Admin\Desktop\configuration-Office365-x86.xml

Filesize
1014B

MD5
167a334ac1ab7528b4e2720699e04057

SHA1
7df519f7949450baa105d6636b2440813d51888a

SHA256
2665660837107a692a78c04e3926d2be8c48ca111099148e987527d0bf6b082d

SHA512
4498a57731a293594cbc84ac9e4aea1dcef7b4c0c34f5d07c37609c4ed1c1fd5a2764de945fb838ee97cef08ab9e195a2fd23f80a560e6443809c123fa810077

Download Submit
C:\Users\Admin\Desktop\setup.exe

Filesize
7.1MB

MD5
567a4c265f3d910221c2769e5964c2fb

SHA1
51456f884f115154673ef6a95a8eb3e3ce1d3108

SHA256
6cfc00d087f4d23ac0478cb8da29935f11a7c70dae5240da7455df48b629356b

SHA512
232010a8179eaa7b64dba62910bee8c79a0bbce4e5ae87092c65ef722b2065168f45e8196e0827717eb84fe5f9ea5dc6f251133f8f0075efef6e75ec294feac8

Download Submit
memory/520-64-0x000000006E380000-0x000000006E3CC000-memory.dmp

Filesize
304KB

Download
memory/2400-46-0x0000000007A50000-0x0000000007A76000-memory.dmp

Filesize
152KB

Download
memory/2400-28-0x00000000064C0000-0x000000000650C000-memory.dmp

Filesize
304KB

Download
memory/2400-41-0x0000000007740000-0x00000000077E3000-memory.dmp

Filesize
652KB

Download
memory/2400-42-0x0000000007E70000-0x00000000084EA000-memory.dmp

Filesize
6.5MB

Download
memory/2400-43-0x0000000007810000-0x000000000782A000-memory.dmp

Filesize
104KB

Download
memory/2400-44-0x00000000079C0000-0x00000000079D6000-memory.dmp

Filesize
88KB

Download
memory/2400-45-0x0000000006A80000-0x0000000006A8A000-memory.dmp

Filesize
40KB

Download
memory/2400-29-0x0000000007650000-0x0000000007682000-memory.dmp

Filesize
200KB

Download
memory/2400-30-0x000000006E380000-0x000000006E3CC000-memory.dmp

Filesize
304KB

Download
memory/2400-15-0x0000000005E00000-0x0000000005E66000-memory.dmp

Filesize
408KB

Download
memory/2400-27-0x0000000006480000-0x000000000649E000-memory.dmp

Filesize
120KB

Download
memory/2400-26-0x0000000005FE0000-0x0000000006334000-memory.dmp

Filesize
3.3MB

Download
memory/2400-16-0x0000000005E70000-0x0000000005ED6000-memory.dmp

Filesize
408KB

Download
memory/2400-40-0x0000000006A70000-0x0000000006A8E000-memory.dmp

Filesize
120KB

Download
memory/2400-12-0x0000000002EE0000-0x0000000002F16000-memory.dmp

Filesize
216KB

Download
memory/2400-13-0x00000000057D0000-0x0000000005DF8000-memory.dmp

Filesize
6.2MB

Download
memory/2400-14-0x00000000054E0000-0x0000000005502000-memory.dmp

Filesize
136KB

Download
memory/2764-116-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/2764-119-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/2764-114-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/2764-113-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/2764-111-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/2764-112-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/2764-110-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/2764-118-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/2764-117-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4284-94-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4284-91-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4284-92-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4284-98-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4284-99-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4284-97-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4284-96-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4284-93-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4284-90-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4628-86-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4628-88-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4628-87-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4628-89-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4628-83-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4628-84-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4628-81-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4628-82-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download
memory/4628-80-0x00007FFAF4130000-0x00007FFAF4140000-memory.dmp

Filesize
64KB

Download