bcd59d1843ff46e4396336cb6b6dd7fe8d033184be9de2c08bb53e8c541379e6

General

Target
PRODUCTS SHEET 0051937.exe
Size 897KB
Sample240815-e4tm8szcnm
SHA256 bcd59d1843ff46e4396336cb6b6dd7fe8d033184be9de2c08bb53e8c541379e6
MD5 4e6bc8fe92391b837df96be65c0e73e4
SHA1 f0234e22e0d02e178355ffcd1ee5b8fe4c7548c0
SHA512 6ac8be78ca2d5f41732b1e8aba9cff49a32aae5c8b6321271469ce7393963bb8ee8b9ed5ccd68e868863f28106ca2ed2bb07fa260e317c325b0d8259114aefeb
SSDEEP 12288:j2iNvFIsPApIn4l/8ZZrZdGzg5TOjZt0gu3uO+s1zt1M6rkJ1IPae0Do3PNkR:j1DIKPfZrWMT4Ru3uPqwlJSiegWQ
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2640	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PRODUCTS SHEET 0051937.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1832	PRODUCTS SHEET 0051937.exe
1832	PRODUCTS SHEET 0051937.exe
1832	PRODUCTS SHEET 0051937.exe
1832	PRODUCTS SHEET 0051937.exe
1832	PRODUCTS SHEET 0051937.exe
1832	PRODUCTS SHEET 0051937.exe
1832	PRODUCTS SHEET 0051937.exe
1832	PRODUCTS SHEET 0051937.exe
1832	PRODUCTS SHEET 0051937.exe
1832	PRODUCTS SHEET 0051937.exe
2640	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1832	PRODUCTS SHEET 0051937.exe
Token: SeDebugPrivilege	2640	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 1832 wrote to memory of 2640	1832	PRODUCTS SHEET 0051937.exe	30
PID 1832 wrote to memory of 2640	1832	PRODUCTS SHEET 0051937.exe	30
PID 1832 wrote to memory of 2640	1832	PRODUCTS SHEET 0051937.exe	30
PID 1832 wrote to memory of 2640	1832	PRODUCTS SHEET 0051937.exe	30
PID 1832 wrote to memory of 2772	1832	PRODUCTS SHEET 0051937.exe	31
PID 1832 wrote to memory of 2772	1832	PRODUCTS SHEET 0051937.exe	31
PID 1832 wrote to memory of 2772	1832	PRODUCTS SHEET 0051937.exe	31
PID 1832 wrote to memory of 2772	1832	PRODUCTS SHEET 0051937.exe	31
PID 1832 wrote to memory of 2088	1832	PRODUCTS SHEET 0051937.exe	33
PID 1832 wrote to memory of 2088	1832	PRODUCTS SHEET 0051937.exe	33
PID 1832 wrote to memory of 2088	1832	PRODUCTS SHEET 0051937.exe	33
PID 1832 wrote to memory of 2088	1832	PRODUCTS SHEET 0051937.exe	33
PID 1832 wrote to memory of 2716	1832	PRODUCTS SHEET 0051937.exe	34
PID 1832 wrote to memory of 2716	1832	PRODUCTS SHEET 0051937.exe	34
PID 1832 wrote to memory of 2716	1832	PRODUCTS SHEET 0051937.exe	34
PID 1832 wrote to memory of 2716	1832	PRODUCTS SHEET 0051937.exe	34
PID 1832 wrote to memory of 2652	1832	PRODUCTS SHEET 0051937.exe	35
PID 1832 wrote to memory of 2652	1832	PRODUCTS SHEET 0051937.exe	35
PID 1832 wrote to memory of 2652	1832	PRODUCTS SHEET 0051937.exe	35
PID 1832 wrote to memory of 2652	1832	PRODUCTS SHEET 0051937.exe	35
PID 1832 wrote to memory of 2696	1832	PRODUCTS SHEET 0051937.exe	36
PID 1832 wrote to memory of 2696	1832	PRODUCTS SHEET 0051937.exe	36
PID 1832 wrote to memory of 2696	1832	PRODUCTS SHEET 0051937.exe	36
PID 1832 wrote to memory of 2696	1832	PRODUCTS SHEET 0051937.exe	36

C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe
"C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1832
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe
  "C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe"
  2⤵
  PID:2772
- C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe
  "C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe"
  2⤵
  PID:2088
- C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe
  "C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe"
  2⤵
  PID:2716
- C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe
  "C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe"
  2⤵
  PID:2652
- C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe
  "C:\Users\Admin\AppData\Local\Temp\PRODUCTS SHEET 0051937.exe"
  2⤵
  PID:2696

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1832-0-0x00000000740AE000-0x00000000740AF000-memory.dmp

Download

memory/1832-1-0x00000000001E0000-0x00000000002C2000-memory.dmp

Download

memory/1832-2-0x00000000740A0000-0x000000007478E000-memory.dmp

Download

memory/1832-3-0x0000000000400000-0x0000000000412000-memory.dmp

Download

memory/1832-4-0x0000000000490000-0x0000000000498000-memory.dmp

Download

memory/1832-5-0x00000000004A0000-0x00000000004AC000-memory.dmp

Download

memory/1832-6-0x00000000021D0000-0x000000000225A000-memory.dmp

Download

memory/1832-7-0x00000000740A0000-0x000000007478E000-memory.dmp

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads