c7b130f5b5a0c5d2fa4d202143d40393eccd2bcf563c7496a51ee267dd50bc16

Analysis

max time kernel
135s
max time network
53s
platform
windows10-2004_x64
resource
win10v2004-20240508-en
resource tags

arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system
submitted
19-06-2024 11:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
Size

855KB
MD5

93e1256e37cac4fa162ea90eeb7c72b1
SHA1

e0118027062bef44053998f74162d4e125cc2d61
SHA256

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73
SHA512

a34143ad4aa2d09ee08d458c3a22cd9b005dcb20724ea34a00e7ac5ec46d3840cf191a5bb05fad52a50833029bb941c0852b7863475c1e9b92dcc605dccb75ce
SSDEEP

12288:755MHyv+3UDgck8JvirnUdnUwNwtK+CVINPX9yKBg7vjKP:15MHGhS8J3B/moit9yKe/K

Score

7^/10

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe

description	ioc	process
Key value queried	\REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe

Drops startup file 3 IoCs

Processes:

cmd.exe835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe

description	ioc	process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe	cmd.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe	cmd.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nc8f8ruu.lnk	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe

Executes dropped EXE 1 IoCs

Processes:

nc8f8ruu.exe

pid process

1460 nc8f8ruu.exe
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Runs ping.exe 1 TTPs 2 IoCs

Remote System Discovery
T1018

Processes:

PING.EXEPING.EXE

pid process

5000 PING.EXE
5576 PING.EXE

pid	process
1460	nc8f8ruu.exe

pid	process
5000	PING.EXE
5576	PING.EXE

Suspicious behavior: EnumeratesProcesses 26 IoCs

Processes:

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exenheyryryy4u.exenc8f8ruu.exe

pid	process
6024	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
3588	nheyryryy4u.exe
1460	nc8f8ruu.exe
1460	nc8f8ruu.exe

Suspicious behavior: RenamesItself 1 IoCs

Processes:

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe

pid process

6024 835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exenheyryryy4u.exenc8f8ruu.exe

description	pid	process
Token: SeDebugPrivilege	6024	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
Token: SeDebugPrivilege	3588	nheyryryy4u.exe
Token: SeDebugPrivilege	1460	nc8f8ruu.exe

Suspicious use of WriteProcessMemory 15 IoCs

Processes:

835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exenheyryryy4u.execmd.exe

description	pid	process	target process
PID 6024 wrote to memory of 3588	6024	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe	nheyryryy4u.exe
PID 6024 wrote to memory of 3588	6024	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe	nheyryryy4u.exe
PID 6024 wrote to memory of 3588	6024	835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe	nheyryryy4u.exe
PID 3588 wrote to memory of 5712	3588	nheyryryy4u.exe	cmd.exe
PID 3588 wrote to memory of 5712	3588	nheyryryy4u.exe	cmd.exe
PID 3588 wrote to memory of 5712	3588	nheyryryy4u.exe	cmd.exe
PID 5712 wrote to memory of 5000	5712	cmd.exe	PING.EXE
PID 5712 wrote to memory of 5000	5712	cmd.exe	PING.EXE
PID 5712 wrote to memory of 5000	5712	cmd.exe	PING.EXE
PID 5712 wrote to memory of 5576	5712	cmd.exe	PING.EXE
PID 5712 wrote to memory of 5576	5712	cmd.exe	PING.EXE
PID 5712 wrote to memory of 5576	5712	cmd.exe	PING.EXE
PID 5712 wrote to memory of 1460	5712	cmd.exe	nc8f8ruu.exe
PID 5712 wrote to memory of 1460	5712	cmd.exe	nc8f8ruu.exe
PID 5712 wrote to memory of 1460	5712	cmd.exe	nc8f8ruu.exe

C:\Users\Admin\AppData\Local\Temp\835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe
"C:\Users\Admin\AppData\Local\Temp\835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:6024

C:\Users\Admin\AppData\Local\Temp\nheyryryy4u.exe
"C:\Users\Admin\AppData\Local\Temp\nheyryryy4u.exe"
2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588

C:\Windows\SysWOW64\cmd.exe
"cmd" /c ping 127.0.0.1 -n 47 > nul && copy "C:\Users\Admin\AppData\Local\Temp\nheyryryy4u.exe" "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe" && ping 127.0.0.1 -n 47 > nul && "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe"
3⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
PID:5712

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 47
4⤵
- Runs ping.exe
PID:5000

C:\Windows\SysWOW64\PING.EXE
ping 127.0.0.1 -n 47
4⤵
- Runs ping.exe
PID:5576

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe
"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe"
4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1460

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nfjtur874uu\nc8f8ruu.exe
Filesize
855KB

MD5
93e1256e37cac4fa162ea90eeb7c72b1

SHA1
e0118027062bef44053998f74162d4e125cc2d61

SHA256
835e27dcd567204d905fb88c8a7d9e086349f8fd626721e5364041c15a332f73

SHA512
a34143ad4aa2d09ee08d458c3a22cd9b005dcb20724ea34a00e7ac5ec46d3840cf191a5bb05fad52a50833029bb941c0852b7863475c1e9b92dcc605dccb75ce

Download Submit
memory/1460-23-0x0000000000D30000-0x0000000000E0C000-memory.dmp

Filesize
880KB

Download
memory/3588-11-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/3588-17-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/3588-15-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/3588-14-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/3588-13-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/6024-4-0x0000000005A50000-0x0000000005AE2000-memory.dmp

Filesize
584KB

Download
memory/6024-9-0x0000000008040000-0x000000000856C000-memory.dmp

Filesize
5.2MB

Download
memory/6024-7-0x0000000005E10000-0x0000000005E1A000-memory.dmp

Filesize
40KB

Download
memory/6024-12-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/6024-6-0x0000000005C30000-0x0000000005C74000-memory.dmp

Filesize
272KB

Download
memory/6024-5-0x0000000074860000-0x0000000075010000-memory.dmp

Filesize
7.7MB

Download
memory/6024-0-0x000000007486E000-0x000000007486F000-memory.dmp

Filesize
4KB

Download
memory/6024-3-0x0000000006000000-0x00000000065A4000-memory.dmp

Filesize
5.6MB

Download
memory/6024-2-0x00000000059B0000-0x0000000005A4C000-memory.dmp

Filesize
624KB

Download
memory/6024-1-0x0000000000B30000-0x0000000000C0C000-memory.dmp

Filesize
880KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads