Analysis
- max time kernel
133s - max time network
123s - platform
windows10-2004_x64 - resource
win10v2004-20240802-en - resource tags
- submitted
18/08/2024, 16:15
General
- Target PO TIYEY078K.exe
- Size 870KB
- Sample240818-tp8k6ssbmb
- SHA256 d5817e8cfa2e2f8abb5feea016308efb1cd84e4f15ddd6b9e48692f626b8f927
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 16 IoCs
- Suspicious use of AdjustPrivilegeToken 1 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO TIYEY078K.exe"C:\Users\Admin\AppData\Local\Temp\PO TIYEY078K.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO TIYEY078K.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\PO TIYEY078K.exe"C:\Users\Admin\AppData\Local\Temp\PO TIYEY078K.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_wxf5s5cc.cly.ps1
memory/3012-12-0x0000000000400000-0x0000000000447000-memory.dmp
memory/3012-64-0x0000000000400000-0x0000000000447000-memory.dmp
memory/3012-63-0x0000000001170000-0x00000000014BA000-memory.dmp
memory/3012-62-0x0000000000400000-0x0000000000447000-memory.dmp
memory/3012-14-0x0000000000400000-0x0000000000447000-memory.dmp
memory/4200-11-0x000000000C2A0000-0x000000000C33C000-memory.dmp
memory/4200-5-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/4200-8-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/4200-9-0x00000000069F0000-0x0000000006A06000-memory.dmp
memory/4200-10-0x00000000019A0000-0x0000000001A2E000-memory.dmp
memory/4200-0-0x000000007494E000-0x000000007494F000-memory.dmp
memory/4200-6-0x0000000006F30000-0x0000000006F4E000-memory.dmp
memory/4200-4-0x0000000005A30000-0x0000000005A3A000-memory.dmp
memory/4200-15-0x0000000074940000-0x00000000750F0000-memory.dmp
memory/4200-1-0x0000000000DC0000-0x0000000000E9E000-memory.dmp
memory/4200-2-0x0000000005D40000-0x00000000062E4000-memory.dmp
memory/4200-3-0x0000000005870000-0x0000000005902000-memory.dmp
memory/4200-7-0x000000007494E000-0x000000007494F000-memory.dmp
memory/4576-33-0x0000000006880000-0x000000000689E000-memory.dmp
memory/4576-51-0x0000000007BC0000-0x0000000007BDA000-memory.dmp
memory/4576-20-0x0000000005FF0000-0x0000000006012000-memory.dmp
memory/4576-21-0x0000000006190000-0x00000000061F6000-memory.dmp
memory/4576-32-0x0000000006270000-0x00000000065C4000-memory.dmp
memory/4576-34-0x00000000068B0000-0x00000000068FC000-memory.dmp
memory/4576-19-0x0000000005980000-0x0000000005FA8000-memory.dmp
memory/4576-47-0x0000000007890000-0x0000000007933000-memory.dmp
memory/4576-46-0x0000000007870000-0x000000000788E000-memory.dmp
memory/4576-36-0x0000000070800000-0x000000007084C000-memory.dmp
memory/4576-35-0x0000000006E40000-0x0000000006E72000-memory.dmp
memory/4576-48-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/4576-49-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/4576-22-0x0000000006200000-0x0000000006266000-memory.dmp
memory/4576-50-0x0000000008200000-0x000000000887A000-memory.dmp
memory/4576-52-0x0000000007C30000-0x0000000007C3A000-memory.dmp
memory/4576-53-0x0000000007E40000-0x0000000007ED6000-memory.dmp
memory/4576-54-0x0000000007DC0000-0x0000000007DD1000-memory.dmp
memory/4576-55-0x0000000007DF0000-0x0000000007DFE000-memory.dmp
memory/4576-56-0x0000000007E00000-0x0000000007E14000-memory.dmp
memory/4576-57-0x0000000007F00000-0x0000000007F1A000-memory.dmp
memory/4576-58-0x0000000007EE0000-0x0000000007EE8000-memory.dmp
memory/4576-61-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/4576-17-0x00000000749EE000-0x00000000749EF000-memory.dmp
memory/4576-18-0x00000000749E0000-0x0000000075190000-memory.dmp
memory/4576-16-0x0000000002F80000-0x0000000002FB6000-memory.dmp