6c293ea8f03820bb8aa0a32d819fe52f278a11edba5d8ca640da6dcec3aadb71

Analysis

max time kernel
93s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240426-en
resource tags

arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system
submitted
09/06/2024, 03:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
7012be602b08edfbf8ba9bbb0a78b590.exe
Size 8.4MB
Sample240609-dwgs2adf42
SHA256 6c293ea8f03820bb8aa0a32d819fe52f278a11edba5d8ca640da6dcec3aadb71
MD5 7012be602b08edfbf8ba9bbb0a78b590
SHA1 3fb04fe68adc3a466d915a5ada209c4cb9baa09b
SHA512 3c47cceba6759001afcbbf569c05c0c429296cc8bb460e68950bf46b32ceb261fd3b4846445e94e8106a95e27dd7966f9a6356489eec6f38313a72b2c55c02ac
SSDEEP 98304:5XbEhsqluBejQWFdSJ1y334JjlC5EsR9NjzdCH7W4U6IHTzIU2WDFTy0+lI:lWd9aJjlC5EsR9NHdCH7LU6SwlI
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\Control Panel\International\Geo\Nation	7012be602b08edfbf8ba9bbb0a78b590.exe

Executes dropped EXE 1 IoCs

pid	Process
1960	svchost.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3906287020-2915474608-1755617787-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\""	7012be602b08edfbf8ba9bbb0a78b590.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Creates scheduled task(s) 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence

Scheduled Task/Job

T1053

pid	Process
4192	schtasks.exe

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
3352	timeout.exe

Suspicious behavior: EnumeratesProcesses 23 IoCs

pid	Process
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1168	7012be602b08edfbf8ba9bbb0a78b590.exe
1960	svchost.exe
1960	svchost.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1168	7012be602b08edfbf8ba9bbb0a78b590.exe
Token: SeDebugPrivilege	1960	svchost.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1168 wrote to memory of 3076	1168	7012be602b08edfbf8ba9bbb0a78b590.exe	84
PID 1168 wrote to memory of 3076	1168	7012be602b08edfbf8ba9bbb0a78b590.exe	84
PID 1168 wrote to memory of 3076	1168	7012be602b08edfbf8ba9bbb0a78b590.exe	84
PID 1168 wrote to memory of 932	1168	7012be602b08edfbf8ba9bbb0a78b590.exe	86
PID 1168 wrote to memory of 932	1168	7012be602b08edfbf8ba9bbb0a78b590.exe	86
PID 1168 wrote to memory of 932	1168	7012be602b08edfbf8ba9bbb0a78b590.exe	86
PID 932 wrote to memory of 3352	932	cmd.exe	89
PID 932 wrote to memory of 3352	932	cmd.exe	89
PID 932 wrote to memory of 3352	932	cmd.exe	89
PID 3076 wrote to memory of 4192	3076	cmd.exe	88
PID 3076 wrote to memory of 4192	3076	cmd.exe	88
PID 3076 wrote to memory of 4192	3076	cmd.exe	88
PID 932 wrote to memory of 1960	932	cmd.exe	92
PID 932 wrote to memory of 1960	932	cmd.exe	92
PID 932 wrote to memory of 1960	932	cmd.exe	92
PID 1960 wrote to memory of 4476	1960	svchost.exe	95
PID 1960 wrote to memory of 4476	1960	svchost.exe	95
PID 1960 wrote to memory of 4476	1960	svchost.exe	95

C:\Users\Admin\AppData\Local\Temp\7012be602b08edfbf8ba9bbb0a78b590.exe
"C:\Users\Admin\AppData\Local\Temp\7012be602b08edfbf8ba9bbb0a78b590.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1168
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"' & exit
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:3076
- - C:\Windows\SysWOW64\schtasks.exe
    schtasks /create /f /sc onlogon /rl highest /tn "svchost" /tr '"C:\Users\Admin\AppData\Roaming\svchost.exe"'
    3⤵
    - Creates scheduled task(s)
    PID:4192
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp3364.tmp.bat""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:932
- - C:\Windows\SysWOW64\timeout.exe
    timeout 3
    3⤵
    - Delays execution with timeout.exe
    PID:3352
- - C:\Users\Admin\AppData\Roaming\svchost.exe
    "C:\Users\Admin\AppData\Roaming\svchost.exe"
    3⤵
    - Executes dropped EXE
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1960
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\System32\svchost.exe"
      4⤵
      PID:4476

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Scheduled Task/Job

T1053

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmp3364.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\tmp3364.tmp.bat
Size 151B
SHA256 33f6b99eb64d27abf9709037604057786fffa01ae685fde47498ae24a488f9bb
MD5 8696e7415ce1585109dfd7cd2c10fe58
SHA1 49167d06c8b7d416c53eabac70b128bc453248b9
SHA512 eb0825caab71e503002c669a8db6bd16a8a5089ce40bf5a89b582e869cce7a60de0c83e7d845bfb12f72912a48cda6079eba2464e593004e6a5e481d526e716c
MD5 SHA1 SHA512

Submit Download

svchost.exe

Path C:\Users\Admin\AppData\Roaming\svchost.exe
Size 8.4MB
SHA256 6c293ea8f03820bb8aa0a32d819fe52f278a11edba5d8ca640da6dcec3aadb71
MD5 7012be602b08edfbf8ba9bbb0a78b590
SHA1 3fb04fe68adc3a466d915a5ada209c4cb9baa09b
SHA512 3c47cceba6759001afcbbf569c05c0c429296cc8bb460e68950bf46b32ceb261fd3b4846445e94e8106a95e27dd7966f9a6356489eec6f38313a72b2c55c02ac
SSDEEP 98304:5XbEhsqluBejQWFdSJ1y334JjlC5EsR9NjzdCH7W4U6IHTzIU2WDFTy0+lI:lWd9aJjlC5EsR9NHdCH7LU6SwlI
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1168-6-0x0000000074BD0000-0x0000000075380000-memory.dmp

Download

memory/1168-3-0x0000000006450000-0x00000000069F4000-memory.dmp

Download

memory/1168-4-0x0000000005F40000-0x0000000005FD2000-memory.dmp

Download

memory/1168-5-0x0000000005EE0000-0x0000000005EFE000-memory.dmp

Download

memory/1168-0-0x0000000074BDE000-0x0000000074BDF000-memory.dmp

Download

memory/1168-8-0x00000000062D0000-0x00000000062EA000-memory.dmp

Download

memory/1168-7-0x00000000061B0000-0x00000000062A2000-memory.dmp

Download

memory/1168-14-0x0000000074BD0000-0x0000000075380000-memory.dmp

Download

memory/1168-2-0x0000000005DF0000-0x0000000005E66000-memory.dmp

Download

memory/1168-1-0x0000000000BD0000-0x0000000001432000-memory.dmp

Download

memory/1960-18-0x0000000074BD0000-0x0000000075380000-memory.dmp

Download

memory/1960-19-0x0000000006110000-0x000000000611A000-memory.dmp

Download

memory/1960-20-0x0000000074BD0000-0x0000000075380000-memory.dmp

Download