d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277

Analysis

max time kernel
18s
max time network
19s
platform
windows7_x64
resource
win7-20240704-en
resource tags

arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
submitted
21-08-2024 11:12

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
Size

688KB
MD5

44919bd4c653cbd956628a0a5c1adf22
SHA1

c09669285e613c1cada8b50b0e9704dfd93fa31d
SHA256

d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277
SHA512

ffdf8c78835070e82672c38f634f710f7505061f36267cd0f034a07b061e65f89a7f0ade93e5c89a6691ad2770f05f8f69f70c0196bec2efb29220b17657385e
SSDEEP

12288:TNqsCwgqaVouc0PlsfdG2FXwC++UuVFK2T2y9Xl4mOv7TPbiH34ihoIgyo:TTC/qaSucKMduaFK2SwVLc7TsBhoI

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2792	powershell.exe
2880	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
2792	powershell.exe
2880	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
Token: SeDebugPrivilege	2792	powershell.exe
Token: SeDebugPrivilege	2880	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2432 wrote to memory of 2792	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	29
PID 2432 wrote to memory of 2792	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	29
PID 2432 wrote to memory of 2792	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	29
PID 2432 wrote to memory of 2792	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	29
PID 2432 wrote to memory of 2880	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	31
PID 2432 wrote to memory of 2880	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	31
PID 2432 wrote to memory of 2880	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	31
PID 2432 wrote to memory of 2880	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	31
PID 2432 wrote to memory of 2744	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	33
PID 2432 wrote to memory of 2744	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	33
PID 2432 wrote to memory of 2744	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	33
PID 2432 wrote to memory of 2744	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	33
PID 2432 wrote to memory of 1632	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	35
PID 2432 wrote to memory of 1632	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	35
PID 2432 wrote to memory of 1632	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	35
PID 2432 wrote to memory of 1632	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	35
PID 2432 wrote to memory of 2812	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	36
PID 2432 wrote to memory of 2812	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	36
PID 2432 wrote to memory of 2812	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	36
PID 2432 wrote to memory of 2812	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	36
PID 2432 wrote to memory of 876	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	37
PID 2432 wrote to memory of 876	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	37
PID 2432 wrote to memory of 876	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	37
PID 2432 wrote to memory of 876	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	37
PID 2432 wrote to memory of 676	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	38
PID 2432 wrote to memory of 676	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	38
PID 2432 wrote to memory of 676	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	38
PID 2432 wrote to memory of 676	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	38
PID 2432 wrote to memory of 1748	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	39
PID 2432 wrote to memory of 1748	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	39
PID 2432 wrote to memory of 1748	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	39
PID 2432 wrote to memory of 1748	2432	d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe	39

C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
"C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2432
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2792
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\XVVpBOUshDsO.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2880
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\XVVpBOUshDsO" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2923.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
  "C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe"
  2⤵
  PID:1632
- C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
  "C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe"
  2⤵
  PID:2812
- C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
  "C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe"
  2⤵
  PID:876
- C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
  "C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe"
  2⤵
  PID:676
- C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe
  "C:\Users\Admin\AppData\Local\Temp\d100685c3e62fde73e33854186142c68d4fdab117a4c2eb11a1c73dc362a1277.exe"
  2⤵
  PID:1748

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2923.tmp

Filesize
1KB

MD5
af4d0cc59c38c97c278fb4f9dc062dd9

SHA1
a2ae5ac66d53875da172e390e5983b2d8e0629e6

SHA256
67e8f609f029c113a929312f1233f83e8888d5d928b4ee6a19743f32574e2f23

SHA512
60c820b13e5c6fe3fe48a5c5a286e6351a11f55c8e3651d6956a79c59d98bc7675497fab563c58f2a00c082edc6fa71882d8a985ee71ac2c9432da3e37255d17

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
b244197aa7207acfe9b1f7f15ad03c5b

SHA1
f052c98e025fd9db24dd5339a02ad1b7977c2331

SHA256
3ea8442c286f1c01dd13b2581c2c7b6573536450d1037f39fa740ead48422c2f

SHA512
b7437eb4f72b4b8d2f60ff5adb4d1833dc882a93a0ca1ae5abeb2dd18674c7d75daf390e417f474082ca421965feedbaeda8fbb3b79c35b30cf0ece0a59e1c50

Download Submit
memory/2432-0-0x0000000073C4E000-0x0000000073C4F000-memory.dmp

Filesize
4KB

Download
memory/2432-1-0x0000000000380000-0x0000000000432000-memory.dmp

Filesize
712KB

Download
memory/2432-2-0x0000000073C40000-0x000000007432E000-memory.dmp

Filesize
6.9MB

Download
memory/2432-3-0x0000000000350000-0x0000000000362000-memory.dmp

Filesize
72KB

Download
memory/2432-4-0x0000000073C4E000-0x0000000073C4F000-memory.dmp

Filesize
4KB

Download
memory/2432-5-0x0000000073C40000-0x000000007432E000-memory.dmp

Filesize
6.9MB

Download
memory/2432-6-0x0000000000370000-0x0000000000380000-memory.dmp

Filesize
64KB

Download
memory/2432-7-0x00000000044A0000-0x0000000004516000-memory.dmp

Filesize
472KB

Download
memory/2432-20-0x0000000073C40000-0x000000007432E000-memory.dmp

Filesize
6.9MB

Download