b2a9d9fa76e0d276d2a9ee93a0cd32a7796ffa5c5481dba57c89c0590fb61d09

Analysis

max time kernel
128s
max time network
137s
platform
windows11-21h2_x64
resource
win11-20240508-en
resource tags

arch:x64arch:x86image:win11-20240508-enlocale:en-usos:windows11-21h2-x64system
submitted
11/06/2024, 17:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
New/dgbw.exe
Size 570KB
Sample240611-v35bcavdmb
SHA256 acad5da56a5e89b288e11f39789d7583c07972bc5253bcdcea96cb020b703474
MD5 d6ead5d81986e9e21984c4ee8df32183
SHA1 7eb429ce51bf900f0ef4aa589cf8a789b6a4792a
SHA512 13aba25679b8e3fe1b96ba94262d6afaa57f8554f7dc31e4643a417545ef292537e7e09cc5ec4c5c0c418b3057009eabfee00c5cf89d0a0354be2a7ff484f0be
SSDEEP 12288:LQM9bROJmafSPZDz7qElw2KxPo0q7qzC9b/uEvtHKYTsviIR8Cufe9ZqQwExr//M:Ld9Mrf7iaNVxowsTNkw
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
3372	csrss.exe
2576	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive	powershell.exe
File created	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log	powershell.exe

Drops file in Windows directory 15 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Fonts\systcm32\d.bat	dgbw.exe
File created	C:\Windows\Fonts\systcm32\p.ps1	dgbw.exe
File created	C:\Windows\Fonts\systcm32\d.bat	dgbw.exe
File created	C:\Windows\Fonts\systcm32\narrator.bat	dgbw.exe
File created	C:\Windows\Fonts\systcm32\c.bat	dgbw.exe
File opened for modification	C:\Windows\Fonts\systcm32\n.bat	dgbw.exe
File opened for modification	C:\Windows\Fonts\systcm32\narrator.bat	dgbw.exe
File created	C:\Windows\Fonts\systcm32\1.ini	cmd.exe
File opened for modification	C:\Windows\Fonts\systcm32\c.bat	dgbw.exe
File created	C:\Windows\Fonts\systcm32\n.bat	dgbw.exe
File opened for modification	C:\Windows\Fonts\systcm32\p.ps1	dgbw.exe
File created	C:\Windows\Fonts\systcm32\csrss.exe	dgbw.exe
File opened for modification	C:\Windows\Fonts\systcm32\csrss.exe	dgbw.exe
File created	C:\Windows\Fonts\systcm32\svchost.exe	dgbw.exe
File opened for modification	C:\Windows\Fonts\systcm32\svchost.exe	dgbw.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
3064	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Modifies data under HKEY_USERS 46 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	powershell.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust	powershell.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs	powershell.exe

Runs ping.exe 1 TTPs 5 IoCs

Remote System Discovery

T1018

pid	Process
3200	PING.EXE
3852	PING.EXE
1688	PING.EXE
1216	PING.EXE
3036	PING.EXE

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3624	powershell.exe
3624	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4748	dgbw.exe
Token: SeDebugPrivilege	3624	powershell.exe

Suspicious use of WriteProcessMemory 48 IoCs

description	pid	Process	procid_target
PID 4748 wrote to memory of 2984	4748	dgbw.exe	77
PID 4748 wrote to memory of 2984	4748	dgbw.exe	77
PID 4748 wrote to memory of 2984	4748	dgbw.exe	77
PID 4748 wrote to memory of 1716	4748	dgbw.exe	79
PID 4748 wrote to memory of 1716	4748	dgbw.exe	79
PID 4748 wrote to memory of 1716	4748	dgbw.exe	79
PID 2984 wrote to memory of 3200	2984	cmd.exe	81
PID 2984 wrote to memory of 3200	2984	cmd.exe	81
PID 2984 wrote to memory of 3200	2984	cmd.exe	81
PID 1716 wrote to memory of 3852	1716	cmd.exe	82
PID 1716 wrote to memory of 3852	1716	cmd.exe	82
PID 1716 wrote to memory of 3852	1716	cmd.exe	82
PID 2984 wrote to memory of 3372	2984	cmd.exe	83
PID 2984 wrote to memory of 3372	2984	cmd.exe	83
PID 2984 wrote to memory of 3372	2984	cmd.exe	83
PID 2984 wrote to memory of 1688	2984	cmd.exe	84
PID 2984 wrote to memory of 1688	2984	cmd.exe	84
PID 2984 wrote to memory of 1688	2984	cmd.exe	84
PID 2984 wrote to memory of 1232	2984	cmd.exe	85
PID 2984 wrote to memory of 1232	2984	cmd.exe	85
PID 2984 wrote to memory of 1232	2984	cmd.exe	85
PID 2984 wrote to memory of 3448	2984	cmd.exe	86
PID 2984 wrote to memory of 3448	2984	cmd.exe	86
PID 2984 wrote to memory of 3448	2984	cmd.exe	86
PID 2984 wrote to memory of 2028	2984	cmd.exe	87
PID 2984 wrote to memory of 2028	2984	cmd.exe	87
PID 2984 wrote to memory of 2028	2984	cmd.exe	87
PID 2984 wrote to memory of 4732	2984	cmd.exe	88
PID 2984 wrote to memory of 4732	2984	cmd.exe	88
PID 2984 wrote to memory of 4732	2984	cmd.exe	88
PID 2984 wrote to memory of 4516	2984	cmd.exe	89
PID 2984 wrote to memory of 4516	2984	cmd.exe	89
PID 2984 wrote to memory of 4516	2984	cmd.exe	89
PID 2984 wrote to memory of 1216	2984	cmd.exe	90
PID 2984 wrote to memory of 1216	2984	cmd.exe	90
PID 2984 wrote to memory of 1216	2984	cmd.exe	90
PID 2984 wrote to memory of 3064	2984	cmd.exe	91
PID 2984 wrote to memory of 3064	2984	cmd.exe	91
PID 2984 wrote to memory of 3064	2984	cmd.exe	91
PID 2576 wrote to memory of 3624	2576	svchost.exe	93
PID 2576 wrote to memory of 3624	2576	svchost.exe	93
PID 2576 wrote to memory of 3624	2576	svchost.exe	93
PID 2984 wrote to memory of 3036	2984	cmd.exe	95
PID 2984 wrote to memory of 3036	2984	cmd.exe	95
PID 2984 wrote to memory of 3036	2984	cmd.exe	95
PID 2984 wrote to memory of 3120	2984	cmd.exe	96
PID 2984 wrote to memory of 3120	2984	cmd.exe	96
PID 2984 wrote to memory of 3120	2984	cmd.exe	96

C:\Users\Admin\AppData\Local\Temp\New\dgbw.exe
"C:\Users\Admin\AppData\Local\Temp\New\dgbw.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4748
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Windows\Fonts\systcm32\d.bat" "
  2⤵
  - Drops file in Windows directory
  - Suspicious use of WriteProcessMemory
  PID:2984
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3200
- - C:\Windows\Fonts\systcm32\csrss.exe
    C:\Windows\Fonts\systcm32\csrss.exe SysMaln C:\Windows\Fonts\systcm32\svchost.exe
    3⤵
    - Executes dropped EXE
    PID:3372
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1688
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMaln /v Description /d "Maintains and improves system performance over time" /t reg_sz /f
    3⤵
    PID:1232
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMaln /v DisplayName /d "SysMaln" /t reg_sz /f
    3⤵
    PID:3448
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMaln\Parameters
    3⤵
    PID:2028
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMaln\Parameters /v AppDirectory /d "C:\Windows\Fonts\systcm32" /t reg_sz /f
    3⤵
    PID:4732
- - C:\Windows\SysWOW64\reg.exe
    reg add HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SysMaln\Parameters /v Application /d ""C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" "C:\Windows\Fonts\systcm32\p.ps1"" /t reg_sz /f
    3⤵
    PID:4516
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:1216
- - C:\Windows\SysWOW64\sc.exe
    sc start SysMaln
    3⤵
    - Launches sc.exe
    PID:3064
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1
    3⤵
    - Runs ping.exe
    PID:3036
- - C:\Windows\SysWOW64\regini.exe
    regini 1.ini
    3⤵
    PID:3120
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\HZ~7EE4.tmp.bat"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1716
- - C:\Windows\SysWOW64\PING.EXE
    ping 127.0.0.1 -n 2
    3⤵
    - Runs ping.exe
    PID:3852

C:\Windows\Fonts\systcm32\svchost.exe
C:\Windows\Fonts\systcm32\svchost.exe
1⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:2576
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe C:\Windows\Fonts\systcm32\p.ps1
  2⤵
  - Drops file in System32 directory
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3624

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

HZ~7EE4.tmp.bat

Path C:\Users\Admin\AppData\Local\Temp\HZ~7EE4.tmp.bat
Size 154B
SHA256 96e03c821c62ec6556e4e7b2f1a9d2e5c330cc85e59fde4178a46a4c70b1145e
MD5 022a0d10b043d2f4c53f8aaf4c7b1cb0
SHA1 6c42c3c84c466a5e64d409455f21babe30bf5b3f
SHA512 e116afca21bfe8d765a955883551d2279be8bba0b9cf46ac5af39a85d79a7feab4ac17c2be1ff229f908069c43bbf399818ff09b234ba8c60564a69e122341b5
MD5 SHA1 SHA512

Submit Download

1.ini

Path C:\Windows\Fonts\systcm32\1.ini
Size 68B
SHA256 6b012598ae7d5e1704001d0cbf3d88605a38cb440f600fee58f685ab8de6803d
MD5 c6c1441a5fb7e09711fb910bae0e082e
SHA1 7244e7c14447651b5dfdd694b5b9e0c7f202a6bb
SHA512 31ab5c57a093c6b03f1be76bd2cae21653c637d5920820a20624442ad2bdd7bfc4e2edd25189cb58ba09a6b2d1327ab310769f3d8dc9c1d9dde063927298c982
MD5 SHA1 SHA512

Submit Download

csrss.exe

Path C:\Windows\Fonts\systcm32\csrss.exe
Size 18KB
SHA256 bbf4c224f9861b2c1f5a1364ee71e38728495b2709621763053b979ba88522f1
MD5 c43d1b84143fb2561f22e1a2c8facf53
SHA1 3f1357007f61f02f97f0aaabb8756c6eca2acebd
SHA512 27a25ab6045498e0b7131be58556c685dfa01596675c3af689e61d8329e1a0eff4128c57e202c32c69271b84f57e7425c45fb5fa132ec0f5b352f86323ffa13e
SSDEEP 384:tD7x2ARjcLagJm8lGJ3BY+SpzV5hdfjWNwG:5hRjyppV+8dYwG
MD5 SHA1 SHA512 SSDEEP

Submit Download

d.bat

Path C:\Windows\Fonts\systcm32\d.bat
Size 1003B
SHA256 253efae79c531ac86bb260bf22db225ab1803df20018217ad4eadd3bf68d6883
MD5 851672083b8326ed52b5461e167219a9
SHA1 5d9c5b58b831744520d5d8043e75b60487bbacaa
SHA512 0976f2f084b3bf2d96cf6de774136077c3b59dbc29b38a292382e6ef715ecfe3225c3ecb16c6e0c907400c28a8f82996b05b49e384dad06dff524536a4cbf45c
MD5 SHA1 SHA512

Submit Download

p.ps1

Path C:\Windows\Fonts\systcm32\p.ps1
Size 17KB
SHA256 13aba0939793c189c2f40dd30a4da5d0b36b18c4545edd735a6d9e3d275b8d41
MD5 d300b7fea85fd5d113533d4503a35e66
SHA1 17d26fc4159841f727c9e8f4de46f67ff46fdda1
SHA512 995e473c9e7f2d5fe540902a627fb5da6176019697604d8c1458b685b7d080502e3575605e93d8a8dcf0ec26683bb8b31421a53f38aa3438962fd1edb20453a2
SSDEEP 192:dQFLktkUIwVxPaiRMC5R5oeC+noQR/wRJ2FWxL1OtEyDUDRRh5O/s2k6:ILktkBDiKcfoeC+noQZwkMMwDRRhess
MD5 SHA1 SHA512 SSDEEP

Submit Download

svchost.exe

Path C:\Windows\Fonts\systcm32\svchost.exe
Size 8KB
SHA256 abd4afd71b3c2bd3f741bbe3cec52c4fa63ac78d353101d2e7dc4de2725d1ca1
MD5 4635935fc972c582632bf45c26bfcb0e
SHA1 7c5329229042535fe56e74f1f246c6da8cea3be8
SHA512 167503133b5a0ebd9f8b2971bca120e902497eb21542d6a1f94e52ae8e5b6bde1e4cae1a2c905870a00d772e0df35f808701e2cfbd26dcbb130a5573fa590060
SSDEEP 96:8ldfxd/yKaP64DMI1XT3kaiyMlH38ZldnXFADkYLyAFdfcdTbGu00C:mSP64DMI1DkHMZ36kYLxFdfcdnGu00C
MD5 SHA1 SHA512 SSDEEP

Submit Download

__PSScriptPolicyTest_cgqf1wkp.ejy.ps1

Path C:\Windows\Temp\__PSScriptPolicyTest_cgqf1wkp.ejy.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

memory/3372-22-0x0000000000400000-0x000000000040A000-memory.dmp

Download

memory/3624-28-0x0000000005020000-0x0000000005086000-memory.dmp

Download

memory/3624-29-0x0000000005090000-0x00000000050F6000-memory.dmp

Download

memory/3624-27-0x0000000004870000-0x0000000004892000-memory.dmp

Download

memory/3624-38-0x0000000005100000-0x0000000005457000-memory.dmp

Download

memory/3624-39-0x00000000055E0000-0x00000000055FE000-memory.dmp

Download

memory/3624-40-0x0000000005630000-0x000000000567C000-memory.dmp

Download

memory/3624-26-0x0000000004900000-0x0000000004F2A000-memory.dmp

Download

memory/3624-25-0x0000000001DF0000-0x0000000001E26000-memory.dmp

Download