Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20240705-en
  • resource tags

    arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
  • submitted
    24-07-2024 03:10

General

  • Target

    rfq1960.exe

  • Size

    904KB

  • MD5

    38b63c968b2733cef310a6df2dcfa478

  • SHA1

    bbbb4dcf4ecc6364af54480929d430da1c460a13

  • SHA256

    2768689f6c4a60b7fe18d6c87fdecd8a7f8dceefa298a5851c4a7c6909f3a92d

  • SHA512

    ab9486482bfae4c5a86a5d3dbe9aa47b003d9d74965b5fbd24f72a30ee1bd5a34a75cbcecff98aa3852e7c2019a582f8633bc1c8d762a65ef9084fb00791f3da

  • SSDEEP

    24576:CRv6SSp2ReQ/tOsbwHsIS7NjkDpGrWbv8MXK:CJZeQcsUHPSZjkDpcWb3

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 11 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 28 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\rfq1960.exe
    "C:\Users\Admin\AppData\Local\Temp\rfq1960.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2220
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\TlykqEvmBV.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2572
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TlykqEvmBV" /XML "C:\Users\Admin\AppData\Local\Temp\tmp34C6.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2880
    • C:\Users\Admin\AppData\Local\Temp\rfq1960.exe
      "C:\Users\Admin\AppData\Local\Temp\rfq1960.exe"
      2⤵
        PID:2712
      • C:\Users\Admin\AppData\Local\Temp\rfq1960.exe
        "C:\Users\Admin\AppData\Local\Temp\rfq1960.exe"
        2⤵
          PID:2876
        • C:\Users\Admin\AppData\Local\Temp\rfq1960.exe
          "C:\Users\Admin\AppData\Local\Temp\rfq1960.exe"
          2⤵
            PID:2788
          • C:\Users\Admin\AppData\Local\Temp\rfq1960.exe
            "C:\Users\Admin\AppData\Local\Temp\rfq1960.exe"
            2⤵
              PID:2564
            • C:\Users\Admin\AppData\Local\Temp\rfq1960.exe
              "C:\Users\Admin\AppData\Local\Temp\rfq1960.exe"
              2⤵
                PID:2560

            Network

            MITRE ATT&CK Enterprise v15

            Replay Monitor

            Loading Replay Monitor...

            Downloads

            • C:\Users\Admin\AppData\Local\Temp\tmp34C6.tmp

              Filesize

              1KB

              MD5

              43a38dc28f75ab4d650ef5b0eb44a033

              SHA1

              c6467da6e0f766c1c261f6d8dec9ea32aefcc42d

              SHA256

              3d4ff6c0121eac2b9825b17e9de1fbb39bfe713fa89989522286fd0a9d18120d

              SHA512

              f229ec197b20f4d6f1d279fa7fcede25cd34a09d481201888e1cd997b0525acf1bd763d14238de76860ceba42f0c76d47866589dc81c72172ae246c84d017eb1

            • memory/2220-0-0x0000000073ECE000-0x0000000073ECF000-memory.dmp

              Filesize

              4KB

            • memory/2220-1-0x00000000003F0000-0x00000000004D8000-memory.dmp

              Filesize

              928KB

            • memory/2220-2-0x0000000073EC0000-0x00000000745AE000-memory.dmp

              Filesize

              6.9MB

            • memory/2220-3-0x00000000006A0000-0x00000000006BA000-memory.dmp

              Filesize

              104KB

            • memory/2220-4-0x00000000006D0000-0x00000000006DE000-memory.dmp

              Filesize

              56KB

            • memory/2220-5-0x00000000054D0000-0x000000000558E000-memory.dmp

              Filesize

              760KB

            • memory/2220-13-0x0000000073EC0000-0x00000000745AE000-memory.dmp

              Filesize

              6.9MB