2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb

General

Target

2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe
Size

3.2MB
MD5

6c16807e4417e60366cde4515d148ab3
SHA1

b8212729ae453b48531c5331cfdaea3aa213cf85
SHA256

2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb
SHA512

eb448d72c2d7d74cae67cac46ebc0262e50113b40164d0c9837e4e0d481c23038f85a414dd92561fdbe5958ecdbaa86e8cdd921cc1cc2571eb96f9dd76cc2efe
SSDEEP

49152:6oHBs26nkjh/a3LlwLkl6cV0ymGIj5y60K9F8AA/qDTvyNUjqwZjAN+68OxcIzQW:9B6Wh/9L3clIVy6RwA29NGoN+3OWIzQ

Score

7^/10

execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000\Control Panel\International\Geo\Nation	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe

Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.

Processes:

flow ioc

13 api.ipify.org
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to get system information.
execution

PowerShell
T1059.001

Processes:

powershell.exe

pid process

1200 powershell.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Modifies registry class 1 IoCs

Processes:

calc.exe

description ioc process

Key created \REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings calc.exe

flow	ioc
13	api.ipify.org

description	ioc	process
Key created	\REGISTRY\USER\S-1-5-21-711569230-3659488422-571408806-1000_Classes\Local Settings	calc.exe

Suspicious behavior: EnumeratesProcesses 8 IoCs

Processes:

powershell.exepowershell.exepowershell.exepowershell.exe

pid	process
1200	powershell.exe
1200	powershell.exe
4828	powershell.exe
4828	powershell.exe
2972	powershell.exe
2972	powershell.exe
1532	powershell.exe
1532	powershell.exe

Suspicious use of AdjustPrivilegeToken 26 IoCs

Processes:

powershell.exe2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exepowershell.exepowershell.exepowershell.exe

description	pid	process
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeIncreaseQuotaPrivilege	1200	powershell.exe
Token: SeSecurityPrivilege	1200	powershell.exe
Token: SeTakeOwnershipPrivilege	1200	powershell.exe
Token: SeLoadDriverPrivilege	1200	powershell.exe
Token: SeSystemProfilePrivilege	1200	powershell.exe
Token: SeSystemtimePrivilege	1200	powershell.exe
Token: SeProfSingleProcessPrivilege	1200	powershell.exe
Token: SeIncBasePriorityPrivilege	1200	powershell.exe
Token: SeCreatePagefilePrivilege	1200	powershell.exe
Token: SeBackupPrivilege	1200	powershell.exe
Token: SeRestorePrivilege	1200	powershell.exe
Token: SeShutdownPrivilege	1200	powershell.exe
Token: SeDebugPrivilege	1200	powershell.exe
Token: SeSystemEnvironmentPrivilege	1200	powershell.exe
Token: SeRemoteShutdownPrivilege	1200	powershell.exe
Token: SeUndockPrivilege	1200	powershell.exe
Token: SeManageVolumePrivilege	1200	powershell.exe
Token: 33	1200	powershell.exe
Token: 34	1200	powershell.exe
Token: 35	1200	powershell.exe
Token: 36	1200	powershell.exe
Token: SeDebugPrivilege	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe
Token: SeDebugPrivilege	4828	powershell.exe
Token: SeDebugPrivilege	2972	powershell.exe
Token: SeDebugPrivilege	1532	powershell.exe

Suspicious use of SetWindowsHookEx 1 IoCs

Processes:

OpenWith.exe

pid process

2244 OpenWith.exe

pid	process
2244	OpenWith.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe

description	pid	process	target process
PID 1628 wrote to memory of 1200	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 1200	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 1200	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 4828	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 4828	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 4828	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 2972	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 2972	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 2972	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 1532	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 1532	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 1532	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	powershell.exe
PID 1628 wrote to memory of 4976	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	calc.exe
PID 1628 wrote to memory of 4976	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	calc.exe
PID 1628 wrote to memory of 4976	1628	2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe	calc.exe

C:\Users\Admin\AppData\Local\Temp\2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe
"C:\Users\Admin\AppData\Local\Temp\2379cbf1b539be7380bed6b1c5e1d29c77acc795d291fa2a687819d48df930bb.exe"
1⤵
- Checks computer location settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1628

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" (Get-CimInstance -ClassName Win32_ComputerSystem).TotalPhysicalMemory
2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1200

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-WmiObject Win32_BIOS | Select-Object -ExpandProperty SMBIOSBIOSVersion
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4828

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-WmiObject Win32_PhysicalMemory | Select-Object -ExpandProperty Speed
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2972

C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"powershell" Get-WmiObject Win32_VideoController | Select-Object -ExpandProperty Name
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1532

C:\Windows\SysWOW64\calc.exe
"C:\Windows\System32\calc.exe"
2⤵
- Modifies registry class
PID:4976

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Suspicious use of SetWindowsHookEx
PID:2244

Network

MITRE ATT&CK Matrix ATT&CK v13

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

1

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Resource Development

Reconnaissance

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
Filesize
2KB

MD5
123cd8a916c430f236f9ae908a55cc6d

SHA1
31cbd1fbc8bfe8bed2d0bf569f64ba9681682654

SHA256
7aa5033e789da9d48b185be91ba0763769f9a846d782e02934484d0610b43667

SHA512
24e036c4ddcaefa2069f7bfbc6ef71144595e2db6bef104118347bdcc4061cf321ab0a18e944338cc273d151c76666774cc2c50dbe5c2bf4b9ce8f3119e61da7

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
18KB

MD5
c40d866268e816346464d77fa8b1bc04

SHA1
10dd50af2e5a1ee62e704e708f48189d26443763

SHA256
231cb39b0f6a7a1b23d0135ef1738a66aaea3ba984d37a07135d58761d280fa2

SHA512
e7ff2f658af3c63e476dda20fcdd599fb31a62d85e20e8545a81c53be33b8519f606ab210039352a93bbe4250bc0a56f73845edb3124887c8ebf07112636f5ed

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
17KB

MD5
6c5bb475f7f6ddacecae7b5175cecf12

SHA1
b48212546d616afb28f2e37d9792fd43c6edefbf

SHA256
cfe792c95e3d96a847c511f18a3530dbb93899a36f787e2f65012d3d17976fb9

SHA512
e944c34479b033da1c28f6fecab753fee4f016c0516e5d351641d420e5c8570ecc663d0aba3aa8458d2a3fafcc25f8c585b8f804d5e8705fdee9bebfc9e01053

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
Filesize
16KB

MD5
2441a98df8dcd55df531a6f8391602a3

SHA1
553a4c994f3094f52480b0f9cc48a8ea6e5a061a

SHA256
176ee926dbf2910794567428afd5c9d08328d3fb5d4804ee837a016c4667ad42

SHA512
8dc8fbbf86d2746e19949add9dd3ea83ab28cfa32e9f19403905ef587588f3f8acd53cec4ffe958b6d93e297ecfb99c436b09a6219aad0b142c3d5e7d0575f3e

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_g5jbnspp.jrl.ps1
Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
memory/1200-39-0x0000000007C60000-0x00000000082DA000-memory.dmp

Filesize
6.5MB

Download
memory/1200-41-0x0000000007680000-0x000000000768A000-memory.dmp

Filesize
40KB

Download
memory/1200-8-0x0000000005C50000-0x0000000005CB6000-memory.dmp

Filesize
408KB

Download
memory/1200-7-0x0000000005BE0000-0x0000000005C46000-memory.dmp

Filesize
408KB

Download
memory/1200-4-0x0000000005500000-0x0000000005B28000-memory.dmp

Filesize
6.2MB

Download
memory/1200-14-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/1200-19-0x0000000005DC0000-0x0000000006114000-memory.dmp

Filesize
3.3MB

Download
memory/1200-20-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/1200-21-0x00000000062F0000-0x000000000630E000-memory.dmp

Filesize
120KB

Download
memory/1200-22-0x00000000064A0000-0x00000000064EC000-memory.dmp

Filesize
304KB

Download
memory/1200-23-0x0000000007270000-0x00000000072A2000-memory.dmp

Filesize
200KB

Download
memory/1200-36-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/1200-35-0x00000000072E0000-0x0000000007383000-memory.dmp

Filesize
652KB

Download
memory/1200-34-0x00000000072B0000-0x00000000072CE000-memory.dmp

Filesize
120KB

Download
memory/1200-24-0x0000000070AD0000-0x0000000070B1C000-memory.dmp

Filesize
304KB

Download
memory/1200-37-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/1200-38-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/1200-3-0x0000000004D50000-0x0000000004D86000-memory.dmp

Filesize
216KB

Download
memory/1200-40-0x0000000007610000-0x000000000762A000-memory.dmp

Filesize
104KB

Download
memory/1200-6-0x0000000005310000-0x0000000005332000-memory.dmp

Filesize
136KB

Download
memory/1200-42-0x0000000007800000-0x000000000782A000-memory.dmp

Filesize
168KB

Download
memory/1200-43-0x0000000007830000-0x0000000007854000-memory.dmp

Filesize
144KB

Download
memory/1200-44-0x0000000070C50000-0x0000000070FA4000-memory.dmp

Filesize
3.3MB

Download
memory/1200-46-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/1200-48-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/1200-5-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/1628-49-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/1628-94-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/1628-1-0x0000000000EB0000-0x00000000011E2000-memory.dmp

Filesize
3.2MB

Download
memory/1628-2-0x0000000006070000-0x0000000006614000-memory.dmp

Filesize
5.6MB

Download
memory/1628-0-0x0000000074CDE000-0x0000000074CDF000-memory.dmp

Filesize
4KB

Download
memory/2972-70-0x00000000056E0000-0x0000000005A34000-memory.dmp

Filesize
3.3MB

Download
memory/4828-65-0x0000000006BD0000-0x0000000006C1C000-memory.dmp

Filesize
304KB

Download
memory/4828-66-0x0000000007BB0000-0x0000000007C46000-memory.dmp

Filesize
600KB

Download
memory/4828-67-0x0000000006EF0000-0x0000000006F12000-memory.dmp

Filesize
136KB

Download
memory/4828-69-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/4828-63-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/4828-62-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download
memory/4828-61-0x0000000006410000-0x0000000006764000-memory.dmp

Filesize
3.3MB

Download
memory/4828-51-0x0000000074CD0000-0x0000000075480000-memory.dmp

Filesize
7.7MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Matrix ATT&CK v13

Replay Monitor

Loading Replay Monitor...

Downloads