Analysis
- max time kernel
135s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
25/05/2024, 01:57
Behavioral task
behavioral1
Sample
ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe
Resource
win7-20240221-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe
- Size 145KB
- Sample240525-cdnm7aaf41
- SHA256 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8
- MD5 1813e42a2e7867866ae3644ce0f342a7
- SHA1 739ae80603b8c2d86c35aa59050341995fec4817
- SHA512 b2cf823c376385f2e92d3df25489d79a16833a5766c29a29b90ccc486844c8de831438ce167570b871a6f4f2317ecc83eafa7cc6da2ee81e7b872077ce3e7828
- SSDEEP 3072:S6glyuxE4GsUPnliByocWepJWkCKVaOl4lAF1:S6gDBGpvEByocWeyyVa+4lAF
- MD5 SHA1 SHA512 SSDEEP
Score
7/10
Malware Config
Signatures
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation 9EE0.tmp - Deletes itself 1 IoCs
pid Process 2000 9EE0.tmp - Executes dropped EXE 1 IoCs
pid Process 2000 9EE0.tmp - Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
pid Process 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 2000 9EE0.tmp - Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe - Suspicious behavior: RenamesItself 26 IoCs
pid Process 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp 2000 9EE0.tmp - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeDebugPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: 36 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeImpersonatePrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeIncBasePriorityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeIncreaseQuotaPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: 33 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeManageVolumePrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeProfSingleProcessPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeRestorePrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSystemProfilePrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeTakeOwnershipPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeShutdownPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeDebugPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeBackupPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe Token: SeSecurityPrivilege 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe - Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4956 wrote to memory of 2000 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 95 PID 4956 wrote to memory of 2000 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 95 PID 4956 wrote to memory of 2000 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 95 PID 4956 wrote to memory of 2000 4956 ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe 95 PID 2000 wrote to memory of 5748 2000 9EE0.tmp 96 PID 2000 wrote to memory of 5748 2000 9EE0.tmp 96 PID 2000 wrote to memory of 5748 2000 9EE0.tmp 96
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe"C:\Users\Admin\AppData\Local\Temp\ae378e9945904bf8b4c090d697fe2395a511ed2a36176ddfb7530f22dfc32ac8.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\ProgramData\9EE0.tmp"C:\ProgramData\9EE0.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\9EE0.tmp >> NUL3⤵PID:5748
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\$Recycle.Bin\S-1-5-21-711569230-3659488422-571408806-1000\desktop.ini
- Size 129B
- SHA256 4041b62e91e1cc61d136af393b3187508ee31396790271e78a58ec648078fef1
- MD5 d65dd9c9ef24f5514d6d7f748d210475
- SHA1 d81a802af24cfbc6ab43e1265be000df7a702901
- SHA512 345e2873f1f05319ce66502cdb1fdee21128343b8c3506486876dd4a2a09a90a6171d830bc91accb9665ad7884b24a9b0b327ae480a6eab9db81881919fdb3e8
- MD5 SHA1 SHA512
- Path C:\9yqsodVzM.README.txt
- Size 194B
- SHA256 bc0bb3921720c1b8aacbaa1e0a4b0bb9403cb491fa0e35dacccddae550be827b
- MD5 d800e57bc807b75a347a97dcacd47e9b
- SHA1 4f94193815c6934e72cc65f91393fe451d6b75bb
- SHA512 a763eda98416bcb75adf0c73014ac2e0c30ac3e988e5b0eb511c04fe6163b377b71bc2fa0a0a5fcbcc335b2a14abf961d523261ab4cdb451be90ecd023302ba9
- MD5 SHA1 SHA512
- Path C:\ProgramData\9EE0.tmp
- Size 14KB
- SHA256 917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
- MD5 294e9f64cb1642dd89229fff0592856b
- SHA1 97b148c27f3da29ba7b18d6aee8a0db9102f47c9
- SHA512 b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
- SSDEEP 384:5cFP7VtpK4p+31Mzh79W5vM+ZyUgGq4BtMvAxXCRsi:A7Vf9p+qQ02y5HW6kX
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
- Size 145KB
- SHA256 7ee587db71a749771390b9a947a0d7b05d9383714ac77a326423249fd5c1cc56
- MD5 a99bbb301043eb5ce9a2d911fa0a9578
- SHA1 2cd5c0e165308672bddfb50de79499d78960c32d
- SHA512 bfe7271d0a2ee39fccef76db162fa5793e74bee340271602a70731dd2cb3befecd0ab0e69d0fd67c8850cc874fe70c63024c9203e5e49d8df29af6ba66ee8a72
- SSDEEP 3072:GSl3N91NIzhdSwPCrg0fSVSl3N91NIzhdSwPCrg0fSVSl3N91NIb:GSl95+hdHavfaSl95+hdHavfaSl95i
- MD5 SHA1 SHA512 SSDEEP
- Path F:\$RECYCLE.BIN\S-1-5-21-711569230-3659488422-571408806-1000\DDDDDDDDDDD
- Size 129B
- SHA256 c50563e96cf811b88826525f988902059539d5106014c2b68c71b7b03fe0f8b5
- MD5 db273972f077a7e67e952e4665f42003
- SHA1 681e310e6c47b2071e804130b8f126ff45e48354
- SHA512 93fdf6639a723407ed99ccd63e5723d05f49f66dee40db253a435c88cdf105378d787d1ff016d4a055c96ccc6ff44490f31109c3d724d0ff348bd3cca07b40f0
- MD5 SHA1 SHA512