9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae

General

Target

9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe
Size

2.2MB
MD5

4b031af66c2b1818d6753aa25ecc1d9e
SHA1

9594c741a3642229b610db1ed11d9e48f230d125
SHA256

9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae
SHA512

4fb72f8ce8f3e32a6d6f15f337608b30dac4be68c0c963060c176980dd331f9132394527399efb2c679a39dea84869c06c2058216e9551ff81138f48cd224b8e
SSDEEP

24576:qqBQYkYZuw2RIMzoNPyWKCfo6iZbQQ8HtL6nLimbDVs5l3RuQ55313p:qqFqZbQQ8Ht8LimbQl3z

Score

8^/10

discovery persistence

Malware Config

Signatures

Downloads MZ/PE file

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2412658365-3084825385-3340777666-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows_Thread_Check = "C:\\Windows\\Windows_Thread_Check.exe"	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe

Drops file in Windows directory 4 IoCs

description	ioc	Process
File created	C:\Windows\Windows_Thread_Check.exe	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe
File opened for modification	C:\Windows\Windows_Thread_Check.exe	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe
File created	C:\Windows\Safety22w.exe	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe
File opened for modification	C:\Windows\Safety22w.exe	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ipconfig.exe

Gathers network information 2 TTPs 2 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
2656	ipconfig.exe
1728	ipconfig.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1844 wrote to memory of 1884	1844	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe	84
PID 1844 wrote to memory of 1884	1844	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe	84
PID 1844 wrote to memory of 1884	1844	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe	84
PID 1884 wrote to memory of 2656	1884	cmd.exe	86
PID 1884 wrote to memory of 2656	1884	cmd.exe	86
PID 1884 wrote to memory of 2656	1884	cmd.exe	86
PID 1844 wrote to memory of 3788	1844	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe	93
PID 1844 wrote to memory of 3788	1844	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe	93
PID 1844 wrote to memory of 3788	1844	9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe	93
PID 3788 wrote to memory of 1728	3788	cmd.exe	95
PID 3788 wrote to memory of 1728	3788	cmd.exe	95
PID 3788 wrote to memory of 1728	3788	cmd.exe	95

C:\Users\Admin\AppData\Local\Temp\9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe
"C:\Users\Admin\AppData\Local\Temp\9b77d487c126fd7efd4adf0c880adb105136702d2ed9014757d70571e56f4fae.exe"
1⤵
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1844
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1884
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:2656
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ipconfig /flushdns
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3788
- - C:\Windows\SysWOW64\ipconfig.exe
    ipconfig /flushdns
    3⤵
    - System Location Discovery: System Language Discovery
    - Gathers network information
    PID:1728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1

T1547

Registry Run Keys / Startup Folder

1

T1547.001

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Safety22w.exe

Filesize
33.7MB

MD5
8511bf6b379da283404154d306563367

SHA1
3519032c8ba1c636a5787dd96a1af8ae4af7fc32

SHA256
65f6bc962ca0e6180d0a993449b25c056c087fee507f63f1cae64439a6a33a12

SHA512
6c2bf44354fed609c1a3c817d930fcc948e5198a83a622a3037fd26f4f5486b4a962c170e62e28fb5d82400e7b335e66df5f354d87dbde24bceddf103bed2ee7

Download Submit
C:\Users\Admin\AppData\Local\Temp\Windows_Thread_Check.exe

Filesize
2.2MB

MD5
a4f7e5aeeee620cdbc2965b402050824

SHA1
d2022b13484c2df979970aba19993d730bb7f1b8

SHA256
305ee3137ca2c3d82d62d4152afce966e6056d5f68e37e21ad976cf4cbc207cf

SHA512
1a598203212706a1bf6037d4b2879b5abe67b300e3733d387b261dc659f60a6923b6a90db43cdc3715ec86fd98228b3a64d4154a4c9e40bfb28239b2d86ae165

Download Submit
memory/1844-27-0x0000000000400000-0x000000000052E000-memory.dmp

Filesize
1.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads