Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
24-06-2024 13:27
Behavioral task
behavioral1
Sample
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe
Resource
win7-20240221-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe
-
Size
145KB
-
MD5
c00352e2857075c8f757ea9be769b652
-
SHA1
2a100aa5902ba6f9f35187117182afabf220071b
-
SHA256
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c
-
SHA512
94d7e90ebd6b1d37daa43617a345c463d59096903a55621ff3eb490179411cb7bb58f75bb396a5d2b8720701833dc623ddfb259ad35c0716703a8e4bc66018ad
-
SSDEEP
3072:m6glyuxE4GsUPnliByocWepbN3/1rtqd:m6gDBGpvEByocWeFN3/F8
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
66F7.tmpdescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-1337824034-2731376981-3755436523-1000\Control Panel\International\Geo\Nation 66F7.tmp -
Deletes itself 1 IoCs
Processes:
66F7.tmppid Process 1264 66F7.tmp -
Executes dropped EXE 1 IoCs
Processes:
66F7.tmppid Process 1264 66F7.tmp -
Drops desktop.ini file(s) 2 IoCs
Processes:
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exedescription ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-1337824034-2731376981-3755436523-1000\desktop.ini 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 5 IoCs
Processes:
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe66F7.tmppid Process 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 1264 66F7.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exepid Process 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe -
Suspicious behavior: RenamesItself 26 IoCs
Processes:
66F7.tmppid Process 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp 1264 66F7.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exedescription pid Process Token: SeAssignPrimaryTokenPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeDebugPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: 36 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeImpersonatePrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeIncBasePriorityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeIncreaseQuotaPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: 33 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeManageVolumePrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeProfSingleProcessPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeRestorePrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSystemProfilePrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeTakeOwnershipPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeShutdownPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeDebugPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeBackupPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe Token: SeSecurityPrivilege 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe66F7.tmpdescription pid Process procid_target PID 3128 wrote to memory of 1264 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 82 PID 3128 wrote to memory of 1264 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 82 PID 3128 wrote to memory of 1264 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 82 PID 3128 wrote to memory of 1264 3128 6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe 82 PID 1264 wrote to memory of 2532 1264 66F7.tmp 83 PID 1264 wrote to memory of 2532 1264 66F7.tmp 83 PID 1264 wrote to memory of 2532 1264 66F7.tmp 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe"C:\Users\Admin\AppData\Local\Temp\6371b930d541e441cb5a9234b327395e05501f3405fb45ef13d9c2dabb6aa40c.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3128 -
C:\ProgramData\66F7.tmp"C:\ProgramData\66F7.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1264 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\66F7.tmp >> NUL3⤵PID:2532
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD5ad48d34e57eb4c06dba439ee0f9ccff8
SHA1a270146024d3289d460acf5431ed5683dfd1be35
SHA2565fb1692fe589875cb8d094ae86c0707e4cabce3189d8c6f86b855d16faebc996
SHA512956d3574003ee207650d03b66edcb602a5ed96c7b39fd2bd8ace3868011085c70ccf9372a80a53858fa244c68a08a53f606da76efd7a15fe7509eac3567bbad3
-
Filesize
354B
MD582477511bd66d813474e640b636bba76
SHA1045c9f40e45f02e9154166a012e5a021ae5e3ca8
SHA256bc381eb017ab84d17eb6f3ae994305ef1edd3898d5ec140b2dd5ba478c81e428
SHA51212d62cece6f54188720ea3381b4695129e06aed7c7ff9f0170f349b47bfdb8eff93fa3d682bb2e995310586088cd5a27e28b14a2f85bedd9568d3451ab9966c4
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize145KB
MD563097b02f48a20dc7f46e496a9b88715
SHA1174e313c8274deca5c6cdae29bc8e0445180078e
SHA256ef6ba6cfd6b2c05ce745574403fbdd22694c858b99400e71df61a6c6d41e3389
SHA512db33760320eda7b6cc91966ed14d7d2c166e7f92798635fe14adb3876b0236f1001e052b2be832e03cae97bd2efd3c7387416b63213f7257556a977ed4f50352
-
Filesize
129B
MD5fc2ef2b8b5fec2d45e3a05ff47cfdfd1
SHA11eb276369090676831bc87c4c6a0146e399a4ca7
SHA256928c804c127af7de75de9196d7b784d383b0cbd5571cb505e91764be8f5b1a09
SHA51258527738eb6674bb12ec9fb70a18dd6f17f961d8774aee95a761859cbc633d4952617d72b7f96c40449899a38affc5483e0458363bbb6d4d5aef57f3fec825f5