Analysis
-
max time kernel
149s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20240508-en -
resource tags
arch:x64arch:x86image:win10v2004-20240508-enlocale:en-usos:windows10-2004-x64system -
submitted
04/07/2024, 00:10
Static task
static1
Behavioral task
behavioral1
Sample
8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe
Resource
win7-20240611-en
windows7-x64
Behavioral task
behavioral2
Sample
8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe
Resource
win10v2004-20240508-en
windows10-2004-x64
General
-
Target
8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe
-
Size
18KB
-
MD5
9b28f0a393a2b5879a54e0f83987deb0
-
SHA1
8a3b0583fd92fbbb85e85ebc4018ad693e9df26f
-
SHA256
8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be
-
SHA512
9bf94e44e33f6714146aced24b8505ca801499b9ba62f00a46a309d32f22330f45fa522e7d1840bf8b8f984937e86cfd6e9faf09323f8cc85061ec4a003c9d10
-
SSDEEP
384:r6eHIAx0pqNgHvRtoyhAkeKE7pDKbR6hcdBYpBmLE:r6eHIMgPRtzykeKE7pkRpTE
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\Control Panel\International\Geo\Nation 8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe -
Executes dropped EXE 1 IoCs
pid Process 4748 trys.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4124900551-4068476067-3491212533-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ineter Mc = "C:\\Users\\Admin\\AppData\\Roaming\\trys.exe" reg.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe Token: SeDebugPrivilege 4748 trys.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2684 8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe 4748 trys.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2684 wrote to memory of 3600 2684 8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe 81 PID 2684 wrote to memory of 3600 2684 8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe 81 PID 2684 wrote to memory of 3600 2684 8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe 81 PID 3600 wrote to memory of 4816 3600 cmd.exe 84 PID 3600 wrote to memory of 4816 3600 cmd.exe 84 PID 3600 wrote to memory of 4816 3600 cmd.exe 84 PID 2684 wrote to memory of 4748 2684 8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe 85 PID 2684 wrote to memory of 4748 2684 8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe 85 PID 2684 wrote to memory of 4748 2684 8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe"C:\Users\Admin\AppData\Local\Temp\8212b521d5f17a1dec98c2bbbc4269c1c8993259d174095956a1e49e4ac071be.exe"1⤵
- Checks computer location settings
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AOXOC.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:3600 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\trys.exe" /f3⤵
- Adds Run key to start application
PID:4816
-
-
-
C:\Users\Admin\AppData\Roaming\trys.exe"C:\Users\Admin\AppData\Roaming\trys.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4748
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
135B
MD56dbb2090ff90500da05a027765cde190
SHA1425b833d9d1df8d6df6e5a59f738058808271949
SHA25671ca0761f7187f2164f62b23d5d9d2dcfd28d9ab9a8dfc14796c3ac06db03881
SHA5127e4679e04bd5a69c026949a0d2760a630bc02249a04f3bd224dee41d1bf10f0a29e45812a67c583327a63e5401f0ff2aa9a3f4df8233b150943052c97e861ab3
-
Filesize
18KB
MD56e16b64219df837afd7df95761289d5c
SHA190ac6932dbd752b3c6bf062d7e78a191a911d07e
SHA2566c8aaca186c760a71faeb29abab1e727118ed944bd44b99cae81418c14b69925
SHA5127dca3b82bcbd0f477b59d1637843e60c7f88b687d6c2925a81f36943b355351e7cb3f13a2a4b633ddec42bdc77437474475fa229f9aa78b28dd7a07e8ba39426