Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
26-07-2024 09:54
Static task
static1
Behavioral task
behavioral1
Sample
bc43851a4132b4bd01e72b3da4f97460N.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
bc43851a4132b4bd01e72b3da4f97460N.exe
Resource
win10v2004-20240709-en
General
-
Target
bc43851a4132b4bd01e72b3da4f97460N.exe
-
Size
4.2MB
-
MD5
bc43851a4132b4bd01e72b3da4f97460
-
SHA1
73dde316598b208e1ed2e9d8d342744969090760
-
SHA256
dc87017ebc4e4ca2d7f65e4d3ede241c3c1bd5908cf5fca24c3faadecce54705
-
SHA512
b27db04034bbc4616e18ac42c3ae3cdbb3f993a785413c5d5dbe5c61b7e621e657d835ad7a31dbfc930474b114ac6720bf0ddee13bbfef62608dd546a138d091
-
SSDEEP
24576:ocSRiKAoeMxDa6JtXtSGv7MOfmOh/epNPGi3XxV73LacYLNdK+UwqJ5ji5eB+VyR:
Malware Config
Signatures
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.exedescription pid process target process PID 2688 set thread context of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
bc43851a4132b4bd01e72b3da4f97460N.execmd.exetimeout.exepowershell.exeInstallUtil.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language bc43851a4132b4bd01e72b3da4f97460N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language InstallUtil.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid process 2964 timeout.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
powershell.exepid process 2768 powershell.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.exepowershell.exedescription pid process Token: SeDebugPrivilege 2688 bc43851a4132b4bd01e72b3da4f97460N.exe Token: SeDebugPrivilege 2688 bc43851a4132b4bd01e72b3da4f97460N.exe Token: SeDebugPrivilege 2768 powershell.exe Token: SeDebugPrivilege 2688 bc43851a4132b4bd01e72b3da4f97460N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
InstallUtil.exepid process 676 InstallUtil.exe -
Suspicious use of WriteProcessMemory 28 IoCs
Processes:
bc43851a4132b4bd01e72b3da4f97460N.execmd.exedescription pid process target process PID 2688 wrote to memory of 2796 2688 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 2688 wrote to memory of 2796 2688 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 2688 wrote to memory of 2796 2688 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 2688 wrote to memory of 2796 2688 bc43851a4132b4bd01e72b3da4f97460N.exe cmd.exe PID 2796 wrote to memory of 2964 2796 cmd.exe timeout.exe PID 2796 wrote to memory of 2964 2796 cmd.exe timeout.exe PID 2796 wrote to memory of 2964 2796 cmd.exe timeout.exe PID 2796 wrote to memory of 2964 2796 cmd.exe timeout.exe PID 2688 wrote to memory of 2768 2688 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 2688 wrote to memory of 2768 2688 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 2688 wrote to memory of 2768 2688 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 2688 wrote to memory of 2768 2688 bc43851a4132b4bd01e72b3da4f97460N.exe powershell.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe PID 2688 wrote to memory of 676 2688 bc43851a4132b4bd01e72b3da4f97460N.exe InstallUtil.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bc43851a4132b4bd01e72b3da4f97460N.exe"C:\Users\Admin\AppData\Local\Temp\bc43851a4132b4bd01e72b3da4f97460N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2688 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c timeout 21 & exit2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2796 -
C:\Windows\SysWOW64\timeout.exetimeout 213⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2964 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -enc QQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAFUAcwBlAHIAcwBcAEEAZABtAGkAbgBcAEEAcABwAEQAYQB0AGEAXABMAG8AYwBhAGwAXABUAGUAbQBwAFwAYgBjADQAMwA4ADUAMQBhADQAMQAzADIAYgA0AGIAZAAwADEAZQA3ADIAYgAzAGQAYQA0AGYAOQA3ADQANgAwAE4ALgBlAHgAZQA7ACAAQQBkAGQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUAByAG8AYwBlAHMAcwAgAGIAYwA0ADMAOAA1ADEAYQA0ADEAMwAyAGIANABiAGQAMAAxAGUANwAyAGIAMwBkAGEANABmADkANwA0ADYAMABOAC4AZQB4AGUAOwA=2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2768 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\InstallUtil.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
PID:676
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
144B
MD54c66c278ae33a073d49fd3162fc2b734
SHA1e606e7c4a5bbc883fdde49498e86e2a4cd6cf8c2
SHA256a3141f07bacfe45688c636365228db855b118d8a4669c6ae08e9d17e92837c12
SHA51216524520681aa7d9dd16d12da82ed3a04a3bda0bf32e87d75877a87b05d71ef42cf0c4716acd8edbe80f00f41b6e9749266a287f510fd581b56ecea581100cf3