Overview

overview

8

Static

static

3

2921703b5b...e9.exe

windows7-x64

8

2921703b5b...e9.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    151s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240611-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240611-enlocale:en-usos:windows10-2004-x64system
  • submitted
    19/06/2024, 15:31

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    2921703b5b2148ca96cc58270ac0adeaa7842687c1c05b09cf439940d1ce43e9.exe

  • Size

    160KB

  • MD5

    02e07416de23472dfcc5a97ea6c94fab

  • SHA1

    c309be3db34b541f5b32bb0b811b8eea8b819a3d

  • SHA256

    2921703b5b2148ca96cc58270ac0adeaa7842687c1c05b09cf439940d1ce43e9

  • SHA512

    0d8e38b0bc23a6b56d3b24c19588b2ca5e5bde3d4ec841d3aade9be6f286d0f9f0a1d64ba1c11b688d16a4370985b8e69f98cba798cc2d19b23238174be0aa90

  • SSDEEP

    3072:P2oSgerNIGKoThbHnr5nZUgiVSO+fJ6+W0k:PVSNNIGK2bH3UgiVSO+fJS

Score
8/10
executionpersistencespywarestealer

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

    execution
  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Reads data files stored by FTP clients 2 TTPs

    Tries to access configuration files associated with programs like FileZilla.

    spywarestealer
  • Reads user/profile data of web browsers 2 TTPs

    Infostealers often target stored browser data, which can include saved credentials etc.

    spywarestealer
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 32 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2921703b5b2148ca96cc58270ac0adeaa7842687c1c05b09cf439940d1ce43e9.exe
    "C:\Users\Admin\AppData\Local\Temp\2921703b5b2148ca96cc58270ac0adeaa7842687c1c05b09cf439940d1ce43e9.exe"
    1⤵
    • Checks computer location settings
    • Adds Run key to start application
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2921703b5b2148ca96cc58270ac0adeaa7842687c1c05b09cf439940d1ce43e9.exe & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4600
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionPath C:\Users\Admin\AppData\Local\Temp\2921703b5b2148ca96cc58270ac0adeaa7842687c1c05b09cf439940d1ce43e9.exe
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:2988
    • C:\Windows\System32\cmd.exe
      "C:\Windows\System32\cmd.exe" /k start /b powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension .exe & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2024
      • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
        powershell -inputformat none -outputformat none -NonInteractive -Command Add-MpPreference -ExclusionExtension .exe
        3⤵
        • Command and Scripting Interpreter: PowerShell
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1384
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
      PID:4436

    Network

          MITRE ATT&CK Enterprise v15

          Replay Monitor

          Loading Replay Monitor...

          Downloads

          • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log
            Filesize

            2KB

            MD5

            d85ba6ff808d9e5444a4b369f5bc2730

            SHA1

            31aa9d96590fff6981b315e0b391b575e4c0804a

            SHA256

            84739c608a73509419748e4e20e6cc4e1846056c3fe1929a8300d5a1a488202f

            SHA512

            8c414eb55b45212af385accc16d9d562adba2123583ce70d22b91161fe878683845512a78f04dedd4ea98ed9b174dbfa98cf696370598ad8e6fbd1e714f1f249

            Download Submit

          • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
            Filesize

            64B

            MD5

            3ca1082427d7b2cd417d7c0b7fd95e4e

            SHA1

            b0482ff5b58ffff4f5242d77330b064190f269d3

            SHA256

            31f15dc6986680b158468bf0b4a1c00982b07b2889f360befd8a466113940d8f

            SHA512

            bbcfd8ea1e815524fda500b187483539be4a8865939f24c6e713f0a3bd90b69b4367c36aa2b09886b2006b685f81f0a77eec23ab58b7e2fb75304b412deb6ca3

            Download Submit

          • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_dfktttlj.2nr.ps1
            Filesize

            60B

            MD5

            d17fe0a3f47be24a6453e9ef58c94641

            SHA1

            6ab83620379fc69f80c0242105ddffd7d98d5d9d

            SHA256

            96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

            SHA512

            5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

            Download Submit

          • memory/1384-9-0x000001636E180000-0x000001636E1A2000-memory.dmp

            Filesize

            136KB

            Download

          • memory/1668-31-0x00000133F0740000-0x00000133F0842000-memory.dmp

            Filesize

            1.0MB

            Download

          • memory/1668-0-0x00000133D60A0000-0x00000133D60CE000-memory.dmp

            Filesize

            184KB

            Download

          • memory/1668-2-0x00007FFFAEB80000-0x00007FFFAF641000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/1668-1-0x00007FFFAEB83000-0x00007FFFAEB85000-memory.dmp

            Filesize

            8KB

            Download

          • memory/1668-34-0x00007FFFAEB80000-0x00007FFFAF641000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/1668-33-0x00007FFFAEB83000-0x00007FFFAEB85000-memory.dmp

            Filesize

            8KB

            Download

          • memory/2988-3-0x00007FFFAEB80000-0x00007FFFAF641000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/2988-30-0x00007FFFAEB80000-0x00007FFFAF641000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/2988-24-0x00007FFFAEB80000-0x00007FFFAF641000-memory.dmp

            Filesize

            10.8MB

            Download

          • memory/2988-23-0x00007FFFAEB80000-0x00007FFFAF641000-memory.dmp

            Filesize

            10.8MB

            Download