Overview

overview

4

Static

static

1

b87c096c10...31.exe

windows11-21h2-x64

4

Resubmissions

17/08/2024, 00:49

240817-a6d84s1arp 3

17/08/2024, 00:45

240817-a4km4sxcnc 4

17/08/2024, 00:41

240817-a19g3axblb 3

16/08/2024, 15:13

240816-slrb2s1fra 3

Analysis

  • max time kernel
    120s
  • max time network
    118s
  • platform
    windows11-21h2_x64
  • resource
    win11-20240802-en
  • resource tags

    arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
  • submitted
    17/08/2024, 00:45

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe

  • Size

    410KB

  • MD5

    18152e40100de9cafb257df76f17e51e

  • SHA1

    a310b69302d0945e5b4dcc02692c646a045bbf06

  • SHA256

    b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931

  • SHA512

    be22cdb522df9fe45cbb14db384fcfebfdcd520622455958f6b49f613186c440eb184c6bb2128976377aff02833df153df48f6c8d180ea3bda9bd3047165b0e1

  • SSDEEP

    12288:hHsEjxLDavg3JmwxY1kzE+QIrZoftjNB:lsA+vSoqYAQmZoftn

Score
4/10
discovery

Malware Config

Signatures

  • Drops file in Windows directory 4 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

    discovery
  • Checks SCSI registry key(s) 3 TTPs 3 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of FindShellTrayWindow 64 IoCs
  • Suspicious use of SendNotifyMessage 64 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
    "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
    1⤵
    • System Location Discovery: System Language Discovery
    PID:3244
  • C:\Windows\system32\svchost.exe
    C:\Windows\system32\svchost.exe -k LocalService -p -s NPSMSvc
    1⤵
      PID:3888
    • C:\Windows\System32\oobe\UserOOBEBroker.exe
      C:\Windows\System32\oobe\UserOOBEBroker.exe -Embedding
      1⤵
      • Drops file in Windows directory
      PID:5668
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe
      C:\Users\Admin\AppData\Local\Microsoft\OneDrive\18.151.0729.0013\FileCoAuth.exe -Embedding
      1⤵
      • System Location Discovery: System Language Discovery
      PID:2796
    • C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe
      "C:\Windows\SystemApps\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\MiniSearchHost.exe" -ServerName:MiniSearchUI.AppXj3y73at8fy1htwztzxs68sxx1v7cksp7.mca
      1⤵
      • Modifies registry class
      • Suspicious use of SetWindowsHookEx
      PID:2392
    • C:\Windows\system32\taskmgr.exe
      "C:\Windows\system32\taskmgr.exe" /0
      1⤵
      • Checks SCSI registry key(s)
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      PID:488
    • C:\Windows\System32\rundll32.exe
      C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
      1⤵
        PID:5732
      • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
        "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
        1⤵
        • System Location Discovery: System Language Discovery
        PID:4860
      • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
        "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
        1⤵
        • System Location Discovery: System Language Discovery
        PID:5152
      • C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe
        "C:\Users\Admin\AppData\Local\Temp\b87c096c10d4c1fe5c58e32574a0cc5430e3e1bd65e027b602cd0c8b00d81931.exe"
        1⤵
        • System Location Discovery: System Language Discovery
        PID:6012

      Network

      MITRE ATT&CK Enterprise v15

      Replay Monitor

      Loading Replay Monitor...

      Downloads

      • C:\Users\Admin\AppData\Local\Packages\MicrosoftWindows.Client.CBS_cw5n1h2txyewy\TempState\SearchHoverUnifiedTileModelCache.dat
        Filesize

        10KB

        MD5

        27152171537c47796aa7194ac41383bc

        SHA1

        430c380ea885fce765a771cc40cbfe6358b4d04c

        SHA256

        28276ad4adb3f540918a28a722f10a63406037b96a14e05565e31ec90c605c22

        SHA512

        044ded8d45d2249f69ae617768398a33cf060618f1cb583aa9d9a34171de10bf3e23f6e49b3c0b8ca872f5ecbe98e841168fb3e94fdef2efbb299a3cbc01f616

        Download Submit

      • memory/488-12-0x0000024C846F0000-0x0000024C846F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/488-13-0x0000024C846F0000-0x0000024C846F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/488-11-0x0000024C846F0000-0x0000024C846F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/488-17-0x0000024C846F0000-0x0000024C846F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/488-23-0x0000024C846F0000-0x0000024C846F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/488-22-0x0000024C846F0000-0x0000024C846F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/488-21-0x0000024C846F0000-0x0000024C846F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/488-20-0x0000024C846F0000-0x0000024C846F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/488-19-0x0000024C846F0000-0x0000024C846F1000-memory.dmp

        Filesize

        4KB

        Download

      • memory/488-18-0x0000024C846F0000-0x0000024C846F1000-memory.dmp

        Filesize

        4KB

        Download