Resubmissions

26-07-2024 05:05

240726-frc1ds1drf 10

25-07-2024 07:20

240725-h567hayclf 10

24-07-2024 14:30

240724-rvd8ea1akj 10

24-07-2024 13:56

240724-q83bqasdqb 10

23-07-2024 11:06

240723-m7t26stbmr 10

Analysis

  • max time kernel
    513s
  • max time network
    442s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20240709-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system
  • submitted
    25-07-2024 07:20

General

  • Target

    Release/Server.exe

  • Size

    1.0MB

  • MD5

    97fdf675692906714405d7e9bd6a9c61

  • SHA1

    f388a87852ca61122f2563b9919625d33c7efe78

  • SHA256

    dd3c72966f70692309714ec42461021fef21c26ad33b1b43e3232186b632a44b

  • SHA512

    06f371bbec435746a876bb8127979c46fb1a21949c7f2b1f0e7edd4895382c5018113d52cf86485fa8d269f5c4b597c2739519db11b78bb7574638272ebf925c

  • SSDEEP

    24576:UcBAVQOcXu65lmmomlEkmmsEnE7E7E7EUmemmmmmmIDmeQaKM:USAVQTXuElmmomSkmmtEQQQUmemmmmmL

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Event Triggered Execution: AppInit DLLs 1 TTPs

    Adversaries may establish persistence and/or elevate privileges by executing malicious content triggered by AppInit DLLs loaded into processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 15 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops file in System32 directory 7 IoCs
  • Drops file in Windows directory 8 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies data under HKEY_USERS 8 IoCs
  • Modifies registry class 56 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 3 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 14 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\Release\Server.exe
    "C:\Users\Admin\AppData\Local\Temp\Release\Server.exe"
    1⤵
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Modifies registry class
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SetWindowsHookEx
    PID:864
  • C:\Users\Admin\Desktop\MicrosoftEdge.exe
    "C:\Users\Admin\Desktop\MicrosoftEdge.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Executes dropped EXE
    • Adds Run key to start application
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:888
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /C SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "MicrosoftEdge" /tr "C:\Windows\Vss\Writes\System\Smss.exe" & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4100
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /CrEAte /F /sc OnLoGoN /rl HighEst /tn "MicrosoftEdge" /tr "C:\Windows\Vss\Writes\System\Smss.exe"
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:2160
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "MircosftEdgeServices" /tr "C:\Windows\Vss\Writes\System\Smss.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3044
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo 5 /tn "MircosftEdgeServices" /tr "C:\Windows\Vss\Writes\System\Smss.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:1324
    • C:\Windows\SYSTEM32\CMD.exe
      "CMD" /c SchTaSKs /create /f /sc minute /mo 5 /tn "MicrosoftEdgeUpdater" /tr "C:\Windows\System32\Config\RegBack\Wininit.exe" /RL HIGHEST & exit
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:4632
      • C:\Windows\system32\schtasks.exe
        SchTaSKs /create /f /sc minute /mo 5 /tn "MicrosoftEdgeUpdater" /tr "C:\Windows\System32\Config\RegBack\Wininit.exe" /RL HIGHEST
        3⤵
        • Scheduled Task/Job: Scheduled Task
        PID:704
    • C:\Users\Admin\Desktop\MicrosoftEdge.exe
      C:\Users\Admin\Desktop\MicrosoftEdge.exe /WithTokenOf:TrustedInstaller.exe
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1780
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:3788
  • C:\Windows\system32\wbem\WmiApSrv.exe
    C:\Windows\system32\wbem\WmiApSrv.exe
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    PID:4092
  • C:\Windows\Vss\Writes\System\Smss.exe
    C:\Windows\Vss\Writes\System\Smss.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1764
  • C:\Windows\Vss\Writes\System\Smss.exe
    C:\Windows\Vss\Writes\System\Smss.exe
    1⤵
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1016
  • C:\Windows\System32\Config\RegBack\Wininit.exe
    C:\Windows\System32\Config\RegBack\Wininit.exe
    1⤵
    • Checks computer location settings
    • Executes dropped EXE
    • Loads dropped DLL
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4264
    • C:\Windows\Vss\Writes\System\Smss.exe
      "C:\Windows\Vss\Writes\System\Smss.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Drops file in System32 directory
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1232

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\GMap.NET\DllCache\SQLite_v98_NET4_x86\System.Data.SQLite.DLL

    Filesize

    1.3MB

    MD5

    14393eb908e072fa3164597414bb0a75

    SHA1

    5e04e084ec44a0b29196d0c21213201240f11ba0

    SHA256

    59b9d95ae42e35525fc63f93168fe304409463ee070a3cf21a427a2833564b80

    SHA512

    f5fc3d9e98cca1fbbbe026707086a71f801016348d2355541d630879ad51a850f49eb4a5f7a94e12a844d7a7108d69fa6d762ee19f4805d6aafef16259b4330b

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Smss.exe.log

    Filesize

    871B

    MD5

    386677f585908a33791517dfc2317f88

    SHA1

    2e6853b4560a9ac8a74cdd5c3124a777bc0d874e

    SHA256

    7caf8779608c167ab6fa570df00c973aff6dee850bb63439770889a68c7cdae0

    SHA512

    876d2269e25a4b2754bdf2c7e3c410050f885d7e6bd8abce41c5fc74ae1f8c549b2266dd1588c750f614063f36c8a8e5008cea610505897d04e4ef5c3adc52d9

  • C:\Users\Admin\AppData\Local\Server\Server.exe_Url_jmtcyt32s450mrkqcfhpdrl3u0cpu3sy\1.0.0.0\230o15kv.newcfg

    Filesize

    688B

    MD5

    1b3ada0fdd06f798be1c03cb51b07db6

    SHA1

    da4de6b4d4e3660947059a20e966d01c40d8c2ee

    SHA256

    15f11b3764eca4b990052e1fdfbbb33025baa1455a35e80e5dfef63349ecdf92

    SHA512

    a3d0721cb04eebb677ae80b9738e65aa7c98e9797b08201c548bf1628028a4f3afdb92333703a20ed21cc2fd632733c26524b8d81d9502a7555c9571f3b933d6

  • C:\Users\Admin\AppData\Local\Server\Server.exe_Url_jmtcyt32s450mrkqcfhpdrl3u0cpu3sy\1.0.0.0\user.config

    Filesize

    311B

    MD5

    a35bc67d130a4fb76c2c2831cbdddd55

    SHA1

    66502423bba03870522e50608212b6ee27ebf4c5

    SHA256

    e94a97e512fbc8ed9f5691d921fdeddbff4cc16b024c5335adf66bff3a7a8192

    SHA512

    4401b234d7914afa860e356be1667cc5f44402255f7cc6cc3d8df80883167f6b55463e62156df57be697ee501897fac61a71f97911c6fdb6630272341ac8a07e

  • C:\Users\Admin\AppData\Local\Server\Server.exe_Url_jmtcyt32s450mrkqcfhpdrl3u0cpu3sy\1.0.0.0\user.config

    Filesize

    434B

    MD5

    cfcf8e91857f364e002065c52ff8f91c

    SHA1

    8407ecb3c33a1f3fcf18a723e6884acf7e5a0f4a

    SHA256

    572dda8c7f211dc6a4efc7aecb4a54cb4e0ced1e4c9a4b9f96bb329c983c64e6

    SHA512

    364fecac3a051441b4fefcebb2cc9e38632f99dd04593cd5d9b148986afb09b195e88cdbfa2e778b8934564b76d04fe053f919f0a60769b023f2f753ede06d1e

  • C:\Users\Admin\AppData\Local\Server\Server.exe_Url_jmtcyt32s450mrkqcfhpdrl3u0cpu3sy\1.0.0.0\user.config

    Filesize

    805B

    MD5

    eb5e7c02c1994e15cdaf2a8a052477bf

    SHA1

    8ce675a1d2780867fa05f6698aeff55cf41966de

    SHA256

    8ea66baaffc61a5e5bca357f010dfbb45b57dd3fd0bd528e67c0b65a23e6be44

    SHA512

    cdc8b3725c056abd180b7ac6d15eb5279f330f0ea0c4c2919404b6e2ddf55e3347ffcacb9a9ed47f4c4241874a08be07af354dc8f594860c3b89baf321fb63d4

  • C:\Users\Admin\AppData\Local\Server\Server.exe_Url_jmtcyt32s450mrkqcfhpdrl3u0cpu3sy\1.0.0.0\user.config

    Filesize

    560B

    MD5

    463d2a6611fbb9f0657b8c8c9783f6e0

    SHA1

    9fbda301bda3be3c9c2362b08cf4046857e2612d

    SHA256

    31d89529523e9b788ceec89cb43f1d2d26b44829e720324facf0906251135046

    SHA512

    c2b30090064b389eed8f79429765dc881c74c83352c7bb6e81585b81e9df6010cc89150766e94bf5091279a54b50301a529af70ec2626e2da2a842040424b169

  • C:\Users\Admin\Desktop\MicrosoftEdge.exe

    Filesize

    616KB

    MD5

    5e0cc33aacc7478a9ba3d35e24b1113c

    SHA1

    970bfb230345fcb955146fb95cdb19f589de4ae5

    SHA256

    4d1e3713f8c1f06ef053d3d3d14fe36e2e39dca8874bb633622da89df2de7152

    SHA512

    fc9b5fe7e4af53555e4802a8379996f28cdf06426f9b9e3d55d6c1f5ea22b143032905837b36dd7a3ad9f404626e1f39c066e33495158cd64b274a7f9a9037ed

  • C:\Windows\xdwd.dll

    Filesize

    136KB

    MD5

    16e5a492c9c6ae34c59683be9c51fa31

    SHA1

    97031b41f5c56f371c28ae0d62a2df7d585adaba

    SHA256

    35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

    SHA512

    20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

  • memory/864-57-0x0000000009E10000-0x0000000009E31000-memory.dmp

    Filesize

    132KB

  • memory/864-131-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/864-11-0x00000000099A0000-0x0000000009C82000-memory.dmp

    Filesize

    2.9MB

  • memory/864-12-0x0000000009EF0000-0x000000000A244000-memory.dmp

    Filesize

    3.3MB

  • memory/864-13-0x0000000009710000-0x0000000009732000-memory.dmp

    Filesize

    136KB

  • memory/864-9-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/864-18-0x0000000009760000-0x00000000098AB000-memory.dmp

    Filesize

    1.3MB

  • memory/864-30-0x00000000098B0000-0x00000000098FC000-memory.dmp

    Filesize

    304KB

  • memory/864-31-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/864-8-0x00000000089A0000-0x0000000008A4A000-memory.dmp

    Filesize

    680KB

  • memory/864-7-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/864-6-0x0000000005C10000-0x0000000005C1A000-memory.dmp

    Filesize

    40KB

  • memory/864-56-0x0000000009E50000-0x0000000009E8C000-memory.dmp

    Filesize

    240KB

  • memory/864-0-0x000000007521E000-0x000000007521F000-memory.dmp

    Filesize

    4KB

  • memory/864-67-0x000000000D970000-0x000000000DA22000-memory.dmp

    Filesize

    712KB

  • memory/864-5-0x0000000006760000-0x00000000069B2000-memory.dmp

    Filesize

    2.3MB

  • memory/864-81-0x000000007521E000-0x000000007521F000-memory.dmp

    Filesize

    4KB

  • memory/864-4-0x0000000005C50000-0x0000000005CE2000-memory.dmp

    Filesize

    584KB

  • memory/864-106-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/864-10-0x0000000007620000-0x000000000764C000-memory.dmp

    Filesize

    176KB

  • memory/864-132-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/864-133-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/864-134-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/864-135-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/864-136-0x0000000075210000-0x00000000759C0000-memory.dmp

    Filesize

    7.7MB

  • memory/864-137-0x0000000001570000-0x0000000001692000-memory.dmp

    Filesize

    1.1MB

  • memory/864-1-0x0000000000D00000-0x0000000000E10000-memory.dmp

    Filesize

    1.1MB

  • memory/864-206-0x0000000010610000-0x00000000106AC000-memory.dmp

    Filesize

    624KB

  • memory/864-3-0x0000000005810000-0x000000000586C000-memory.dmp

    Filesize

    368KB

  • memory/864-2-0x0000000005D60000-0x0000000006304000-memory.dmp

    Filesize

    5.6MB

  • memory/888-141-0x00000000008E0000-0x0000000000980000-memory.dmp

    Filesize

    640KB

  • memory/888-236-0x00007FFD14D63000-0x00007FFD14D65000-memory.dmp

    Filesize

    8KB

  • memory/888-350-0x0000000001250000-0x000000000125C000-memory.dmp

    Filesize

    48KB

  • memory/888-349-0x000000001D500000-0x000000001D576000-memory.dmp

    Filesize

    472KB

  • memory/888-351-0x000000001CDF0000-0x000000001CE0E000-memory.dmp

    Filesize

    120KB

  • memory/888-142-0x00007FFD14D63000-0x00007FFD14D65000-memory.dmp

    Filesize

    8KB

  • memory/1780-361-0x0000000002980000-0x00000000029DE000-memory.dmp

    Filesize

    376KB

  • memory/1780-371-0x0000000001060000-0x000000000106A000-memory.dmp

    Filesize

    40KB