dc47961a7054e98a62aaa994e879ee9becbf6096843c899bde226ecbb985f4bd

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20240704-en
resource tags

arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system
submitted
07/07/2024, 05:11

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
279e02fea1b33cbdbfd612f5b2304429.exe
Size 111KB
Sample240707-ft9gdaxamd
SHA256 dc47961a7054e98a62aaa994e879ee9becbf6096843c899bde226ecbb985f4bd
MD5 279e02fea1b33cbdbfd612f5b2304429
SHA1 94cafd8f8053465955869021d73126d81bcc30da
SHA512 c6d08dd2c475ef5461477571a694f0da21cd7a3659d13ad3910fcbb1a9f843ddc6e224a59045a67d219aa6e594a7f62177ab7309e077dc8298136d8f1974bdb7
SSDEEP 1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh73U:w5eznsjsguGDFqGx8egoxmO3rU
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000\Control Panel\International\Geo\Nation	279e02fea1b33cbdbfd612f5b2304429.exe

Executes dropped EXE 1 IoCs

pid	Process
3220	chargeable.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\SysMain = "C:\\Users\\Admin\\AppData\\Local\\Temp\\279e02fea1b33cbdbfd612f5b2304429.exe"	279e02fea1b33cbdbfd612f5b2304429.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3642458265-1901903390-453309326-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\confuse = "C:\\Users\\Admin\\AppData\\Roaming\\confuse\\chargeable.exe"	279e02fea1b33cbdbfd612f5b2304429.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	2068	dw20.exe
Token: SeBackupPrivilege	2068	dw20.exe
Token: SeBackupPrivilege	2068	dw20.exe
Token: SeBackupPrivilege	2068	dw20.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4192 wrote to memory of 3220	4192	279e02fea1b33cbdbfd612f5b2304429.exe	85
PID 4192 wrote to memory of 3220	4192	279e02fea1b33cbdbfd612f5b2304429.exe	85
PID 4192 wrote to memory of 3220	4192	279e02fea1b33cbdbfd612f5b2304429.exe	85
PID 3220 wrote to memory of 2068	3220	chargeable.exe	86
PID 3220 wrote to memory of 2068	3220	chargeable.exe	86
PID 3220 wrote to memory of 2068	3220	chargeable.exe	86

C:\Users\Admin\AppData\Local\Temp\279e02fea1b33cbdbfd612f5b2304429.exe
"C:\Users\Admin\AppData\Local\Temp\279e02fea1b33cbdbfd612f5b2304429.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4192
- C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
  "C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:3220
- - C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
    dw20.exe -x -s 788
    3⤵
    - Checks processor information in registry
    - Enumerates system info in registry
    - Suspicious use of AdjustPrivilegeToken
    PID:2068

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

chargeable.exe

Path C:\Users\Admin\AppData\Roaming\confuse\chargeable.exe
Size 111KB
SHA256 c6787c53b28eb7726ea8847714f7438aae9db23ca8eb8d0bff5897d50d276459
MD5 fea90eeb71fdd24804aaa331cf1aea43
SHA1 795aa26ca6f73503dc053e01a930c00a7744849a
SHA512 fcdde0586baa4e4becc01eb92ce11a3a4b4693269ab6d467e5da5f72a4b7e9e40c3f6b976c35460e155a0216e546bdf7421ca08314d8213d8d4f2ca18b22b85b
SSDEEP 1536:orp5eznKUlIOp3YjVCguHEvQEbFqVC3woFRKpT4xtKegoxmOBh73X:w5eznsjsguGDFqGx8egoxmO3rX
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3220-19-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/3220-18-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/3220-20-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/4192-0-0x0000000074DD2000-0x0000000074DD3000-memory.dmp

Download

memory/4192-1-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/4192-2-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

memory/4192-17-0x0000000074DD0000-0x0000000075381000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads