Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
23/07/2024, 09:20
Behavioral task
behavioral1
Sample
982a0410fa8fbebbac455d7268098000N.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
982a0410fa8fbebbac455d7268098000N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
982a0410fa8fbebbac455d7268098000N.exe
-
Size
134KB
-
MD5
982a0410fa8fbebbac455d7268098000
-
SHA1
62bd54d60f61a3b3e03d416e23bdd01980445bcb
-
SHA256
f8e31e7a15685a6f4fc5a6a13f04200066e5d43e748cb447a52609e93b156d21
-
SHA512
2c3a264b21222d097ad216545938dd0e434524c296cbc08d92a163963c0cb5aec2d6159aa877157648f623c379a2a9103780962dbb7b308102676f5e15e66878
-
SSDEEP
3072:Dxaw7lEvFCsE8uKqMJBrHnsAWNqubkdBytQlaVrAUdB1/:TlFstuKqMJ9Hn5WNqub/tpV841
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation 982a0410fa8fbebbac455d7268098000N.exe -
Executes dropped EXE 3 IoCs
pid Process 3756 trys.exe 2464 trys.exe 3856 trys.exe -
resource yara_rule behavioral2/memory/4956-0-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral2/memory/2524-5-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2524-7-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4956-10-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral2/memory/2524-9-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/files/0x0009000000023413-26.dat upx behavioral2/memory/3756-34-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral2/memory/3756-37-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral2/memory/3856-45-0x0000000013140000-0x0000000013162000-memory.dmp upx behavioral2/memory/3756-41-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral2/memory/3856-47-0x0000000013140000-0x0000000013162000-memory.dmp upx behavioral2/memory/3856-49-0x0000000013140000-0x0000000013162000-memory.dmp upx behavioral2/memory/3756-54-0x0000000000400000-0x0000000000470000-memory.dmp upx behavioral2/memory/3856-53-0x0000000013140000-0x0000000013162000-memory.dmp upx behavioral2/memory/3856-52-0x0000000013140000-0x0000000013162000-memory.dmp upx behavioral2/memory/2524-57-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/2464-58-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Ineter Mc = "C:\\Windows\\trys.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 4956 set thread context of 2524 4956 982a0410fa8fbebbac455d7268098000N.exe 91 PID 3756 set thread context of 2464 3756 trys.exe 98 PID 3756 set thread context of 3856 3756 trys.exe 99 -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\trys.exe 982a0410fa8fbebbac455d7268098000N.exe File opened for modification C:\Windows\trys.exe 982a0410fa8fbebbac455d7268098000N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe Token: SeDebugPrivilege 2464 trys.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 4956 982a0410fa8fbebbac455d7268098000N.exe 2524 982a0410fa8fbebbac455d7268098000N.exe 3756 trys.exe 3756 trys.exe 2464 trys.exe -
Suspicious use of WriteProcessMemory 33 IoCs
description pid Process procid_target PID 4956 wrote to memory of 2524 4956 982a0410fa8fbebbac455d7268098000N.exe 91 PID 4956 wrote to memory of 2524 4956 982a0410fa8fbebbac455d7268098000N.exe 91 PID 4956 wrote to memory of 2524 4956 982a0410fa8fbebbac455d7268098000N.exe 91 PID 4956 wrote to memory of 2524 4956 982a0410fa8fbebbac455d7268098000N.exe 91 PID 4956 wrote to memory of 2524 4956 982a0410fa8fbebbac455d7268098000N.exe 91 PID 4956 wrote to memory of 2524 4956 982a0410fa8fbebbac455d7268098000N.exe 91 PID 4956 wrote to memory of 2524 4956 982a0410fa8fbebbac455d7268098000N.exe 91 PID 4956 wrote to memory of 2524 4956 982a0410fa8fbebbac455d7268098000N.exe 91 PID 2524 wrote to memory of 2496 2524 982a0410fa8fbebbac455d7268098000N.exe 92 PID 2524 wrote to memory of 2496 2524 982a0410fa8fbebbac455d7268098000N.exe 92 PID 2524 wrote to memory of 2496 2524 982a0410fa8fbebbac455d7268098000N.exe 92 PID 2496 wrote to memory of 1716 2496 cmd.exe 95 PID 2496 wrote to memory of 1716 2496 cmd.exe 95 PID 2496 wrote to memory of 1716 2496 cmd.exe 95 PID 2524 wrote to memory of 3756 2524 982a0410fa8fbebbac455d7268098000N.exe 96 PID 2524 wrote to memory of 3756 2524 982a0410fa8fbebbac455d7268098000N.exe 96 PID 2524 wrote to memory of 3756 2524 982a0410fa8fbebbac455d7268098000N.exe 96 PID 3756 wrote to memory of 2464 3756 trys.exe 98 PID 3756 wrote to memory of 2464 3756 trys.exe 98 PID 3756 wrote to memory of 2464 3756 trys.exe 98 PID 3756 wrote to memory of 2464 3756 trys.exe 98 PID 3756 wrote to memory of 2464 3756 trys.exe 98 PID 3756 wrote to memory of 2464 3756 trys.exe 98 PID 3756 wrote to memory of 2464 3756 trys.exe 98 PID 3756 wrote to memory of 2464 3756 trys.exe 98 PID 3756 wrote to memory of 3856 3756 trys.exe 99 PID 3756 wrote to memory of 3856 3756 trys.exe 99 PID 3756 wrote to memory of 3856 3756 trys.exe 99 PID 3756 wrote to memory of 3856 3756 trys.exe 99 PID 3756 wrote to memory of 3856 3756 trys.exe 99 PID 3756 wrote to memory of 3856 3756 trys.exe 99 PID 3756 wrote to memory of 3856 3756 trys.exe 99 PID 3756 wrote to memory of 3856 3756 trys.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\982a0410fa8fbebbac455d7268098000N.exe"C:\Users\Admin\AppData\Local\Temp\982a0410fa8fbebbac455d7268098000N.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4956 -
C:\Users\Admin\AppData\Local\Temp\982a0410fa8fbebbac455d7268098000N.exe"C:\Users\Admin\AppData\Local\Temp\982a0410fa8fbebbac455d7268098000N.exe"2⤵
- Checks computer location settings
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2524 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\KGFSI.bat" "3⤵
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Ineter Mc" /t REG_SZ /d "C:\Windows\trys.exe" /f4⤵
- Adds Run key to start application
PID:1716
-
-
-
C:\Windows\trys.exe"C:\Windows\trys.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3756 -
C:\Windows\trys.exe"C:\Windows\trys.exe"4⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2464
-
-
C:\Windows\trys.exe"C:\Windows\trys.exe"4⤵
- Executes dropped EXE
PID:3856
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115B
MD5721f40b829b989f3ed90feba41b75b51
SHA10bc3e723b65a94c6ffbb8e0b32c9aaa24d10fefd
SHA256641cbc8ccc1d7ffe1030ff40ea930cad57a855c5fa275bff57745b62d4545a15
SHA512d11fa35712baa83380b1515242d85c1ce84ade1bd3e62144906b40c6e2d42c748d7813faaf05e5514048be3ae47fb29986e0a808c93eabf7128f31300c4d972f
-
Filesize
134KB
MD5626b8f04e505a82cb1f5d4f41ddcb511
SHA1e9e4f489e15a495a38e97198ec03590fe9b94423
SHA2561403d8e81a18e91539c0094e72b4f0f1a1aca5fd85dd3dade77fd041b7306eb6
SHA5128ca9b9f17740abeab6fd45671c52dfeb81836f3a8061cd05231d08f6bede6feed979311a7e1661a745c718d0056fc455946887d7195953d0e075a9185acdda5a