e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75

Analysis

max time kernel
140s
max time network
125s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
17/08/2024, 13:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe
Size

1.3MB
MD5

104ac91db66a0418f9c0dd69addba3bd
SHA1

0f590be83ec4c22cfb9b760c12350db6b1dbc343
SHA256

e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75
SHA512

ef1fb744b23f283e11c17ff4457c0b3628040479c9f7440f313ac14a100382887f6d3ef8c180304251c18246bbd43b6ea6091521287541223f347f0b08735c08
SSDEEP

24576:JBsk0UWK5CRXx2puz9gfewGz4nQzQdbSBAo3h3QvrnJM0NL:JB1zWK5CRXUpuj8Hd5M0NL

Score

8^/10

discovery evasion

Malware Config

Signatures

Blocks application from running via registry modification 2 IoCs

Adds application to list of disallowed applications.

evasion

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun	reg.exe
Set value (int)	\REGISTRY\USER\S-1-5-21-3551809350-4263495960-1443967649-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun\powershell.exe = "1"	reg.exe

Disables Task Manager via registry modification
evasion

System Location Discovery: System Language Discovery 1 TTPs 21 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2700	taskkill.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2700	taskkill.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2248	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	31
PID 2432 wrote to memory of 2248	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	31
PID 2432 wrote to memory of 2248	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	31
PID 2432 wrote to memory of 2248	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	31
PID 2248 wrote to memory of 2700	2248	cmd.exe	32
PID 2248 wrote to memory of 2700	2248	cmd.exe	32
PID 2248 wrote to memory of 2700	2248	cmd.exe	32
PID 2248 wrote to memory of 2700	2248	cmd.exe	32
PID 2432 wrote to memory of 2788	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	34
PID 2432 wrote to memory of 2788	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	34
PID 2432 wrote to memory of 2788	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	34
PID 2432 wrote to memory of 2788	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	34
PID 2788 wrote to memory of 2556	2788	cmd.exe	35
PID 2788 wrote to memory of 2556	2788	cmd.exe	35
PID 2788 wrote to memory of 2556	2788	cmd.exe	35
PID 2788 wrote to memory of 2556	2788	cmd.exe	35
PID 2432 wrote to memory of 1036	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	36
PID 2432 wrote to memory of 1036	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	36
PID 2432 wrote to memory of 1036	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	36
PID 2432 wrote to memory of 1036	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	36
PID 1036 wrote to memory of 2768	1036	cmd.exe	37
PID 1036 wrote to memory of 2768	1036	cmd.exe	37
PID 1036 wrote to memory of 2768	1036	cmd.exe	37
PID 1036 wrote to memory of 2768	1036	cmd.exe	37
PID 2432 wrote to memory of 2900	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	38
PID 2432 wrote to memory of 2900	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	38
PID 2432 wrote to memory of 2900	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	38
PID 2432 wrote to memory of 2900	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	38
PID 2900 wrote to memory of 2824	2900	cmd.exe	39
PID 2900 wrote to memory of 2824	2900	cmd.exe	39
PID 2900 wrote to memory of 2824	2900	cmd.exe	39
PID 2900 wrote to memory of 2824	2900	cmd.exe	39
PID 2432 wrote to memory of 2584	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	40
PID 2432 wrote to memory of 2584	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	40
PID 2432 wrote to memory of 2584	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	40
PID 2432 wrote to memory of 2584	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	40
PID 2584 wrote to memory of 2652	2584	cmd.exe	41
PID 2584 wrote to memory of 2652	2584	cmd.exe	41
PID 2584 wrote to memory of 2652	2584	cmd.exe	41
PID 2584 wrote to memory of 2652	2584	cmd.exe	41
PID 2432 wrote to memory of 2848	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	42
PID 2432 wrote to memory of 2848	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	42
PID 2432 wrote to memory of 2848	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	42
PID 2432 wrote to memory of 2848	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	42
PID 2848 wrote to memory of 2576	2848	cmd.exe	43
PID 2848 wrote to memory of 2576	2848	cmd.exe	43
PID 2848 wrote to memory of 2576	2848	cmd.exe	43
PID 2848 wrote to memory of 2576	2848	cmd.exe	43
PID 2432 wrote to memory of 2572	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	44
PID 2432 wrote to memory of 2572	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	44
PID 2432 wrote to memory of 2572	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	44
PID 2432 wrote to memory of 2572	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	44
PID 2572 wrote to memory of 2876	2572	cmd.exe	45
PID 2572 wrote to memory of 2876	2572	cmd.exe	45
PID 2572 wrote to memory of 2876	2572	cmd.exe	45
PID 2572 wrote to memory of 2876	2572	cmd.exe	45
PID 2432 wrote to memory of 2720	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	46
PID 2432 wrote to memory of 2720	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	46
PID 2432 wrote to memory of 2720	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	46
PID 2432 wrote to memory of 2720	2432	e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe	46
PID 2720 wrote to memory of 2688	2720	cmd.exe	47
PID 2720 wrote to memory of 2688	2720	cmd.exe	47
PID 2720 wrote to memory of 2688	2720	cmd.exe	47
PID 2720 wrote to memory of 2688	2720	cmd.exe	47

C:\Users\Admin\AppData\Local\Temp\e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe
"C:\Users\Admin\AppData\Local\Temp\e96ccd431d19b78b1f9315fc0337a8fe4719321574febe1f6015dbda5ceb6c75.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c taskkill /f /im explorer.exe
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2248
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /f /im explorer.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t reg_dword /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2788
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableTaskMgr /t reg_dword /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2556
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion" /v RestrictRun /t reg_dword /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1036
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion" /v RestrictRun /t reg_dword /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2768
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v powershell.exe /t reg_dword /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2900
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\DisallowRun" /v powershell.exe /t reg_dword /d "1" /f
    3⤵
    - Blocks application from running via registry modification
    - System Location Discovery: System Language Discovery
    PID:2824
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t reg_dword /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2584
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer" /v NoClose /t reg_dword /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2652
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkStation reg_dword /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2848
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableLockWorkStation reg_dword /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2576
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2572
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v HideFastUserSwitching /t REG_DWORD /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2876
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword reg_dword /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2720
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableChangePassword reg_dword /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2688
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools reg_dword /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2596
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System" /v DisableRegistryTools reg_dword /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2812
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c reg add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableCMD /t reg_dword /d "1" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2000
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKEY_CURRENT_USER\SOFTWARE\Policies\Microsoft\Windows\System" /v DisableCMD /t reg_dword /d "1" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2552

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2432-0-0x0000000000401000-0x0000000000478000-memory.dmp

Filesize
476KB

Download
memory/2432-1-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download
memory/2432-2-0x0000000000400000-0x00000000004CD000-memory.dmp

Filesize
820KB

Download