7e10d81df9a9375a62ba1fab5eaee1db35d6f1ddf942518a534e0607f6032f84

Analysis

max time kernel
121s
max time network
127s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
23-08-2024 05:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

FedEx_AWB#53052032046.exe
Size

548KB
MD5

62fe99f8cb2b1509d892598a17ed9459
SHA1

96db51d788e67579941fbabea7864776c8df43b9
SHA256

7e10d81df9a9375a62ba1fab5eaee1db35d6f1ddf942518a534e0607f6032f84
SHA512

07498ec1088bda1ce8a7abbb24a9e45a69e27f8533753f3f1638cfb471b3e2983e9a4c6a8b0821aed9bd3e36bf4a37682bfefc83a23351b4d74c37c414e0721a
SSDEEP

12288:IoL3rlW4ipJyiTkGH3klntLbfGajnliDCOcUucwIt/BVxY0kR:7vGii0lhLf7l9OfwqZVmz

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2748	powershell.exe
2600	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	FedEx_AWB#53052032046.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2636	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2796	FedEx_AWB#53052032046.exe
2796	FedEx_AWB#53052032046.exe
2796	FedEx_AWB#53052032046.exe
2796	FedEx_AWB#53052032046.exe
2796	FedEx_AWB#53052032046.exe
2796	FedEx_AWB#53052032046.exe
2796	FedEx_AWB#53052032046.exe
2796	FedEx_AWB#53052032046.exe
2796	FedEx_AWB#53052032046.exe
2796	FedEx_AWB#53052032046.exe
2600	powershell.exe
2748	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2796	FedEx_AWB#53052032046.exe
Token: SeDebugPrivilege	2600	powershell.exe
Token: SeDebugPrivilege	2748	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2796 wrote to memory of 2748	2796	FedEx_AWB#53052032046.exe	30
PID 2796 wrote to memory of 2748	2796	FedEx_AWB#53052032046.exe	30
PID 2796 wrote to memory of 2748	2796	FedEx_AWB#53052032046.exe	30
PID 2796 wrote to memory of 2748	2796	FedEx_AWB#53052032046.exe	30
PID 2796 wrote to memory of 2600	2796	FedEx_AWB#53052032046.exe	32
PID 2796 wrote to memory of 2600	2796	FedEx_AWB#53052032046.exe	32
PID 2796 wrote to memory of 2600	2796	FedEx_AWB#53052032046.exe	32
PID 2796 wrote to memory of 2600	2796	FedEx_AWB#53052032046.exe	32
PID 2796 wrote to memory of 2636	2796	FedEx_AWB#53052032046.exe	33
PID 2796 wrote to memory of 2636	2796	FedEx_AWB#53052032046.exe	33
PID 2796 wrote to memory of 2636	2796	FedEx_AWB#53052032046.exe	33
PID 2796 wrote to memory of 2636	2796	FedEx_AWB#53052032046.exe	33
PID 2796 wrote to memory of 2336	2796	FedEx_AWB#53052032046.exe	36
PID 2796 wrote to memory of 2336	2796	FedEx_AWB#53052032046.exe	36
PID 2796 wrote to memory of 2336	2796	FedEx_AWB#53052032046.exe	36
PID 2796 wrote to memory of 2336	2796	FedEx_AWB#53052032046.exe	36
PID 2796 wrote to memory of 2144	2796	FedEx_AWB#53052032046.exe	37
PID 2796 wrote to memory of 2144	2796	FedEx_AWB#53052032046.exe	37
PID 2796 wrote to memory of 2144	2796	FedEx_AWB#53052032046.exe	37
PID 2796 wrote to memory of 2144	2796	FedEx_AWB#53052032046.exe	37
PID 2796 wrote to memory of 2928	2796	FedEx_AWB#53052032046.exe	38
PID 2796 wrote to memory of 2928	2796	FedEx_AWB#53052032046.exe	38
PID 2796 wrote to memory of 2928	2796	FedEx_AWB#53052032046.exe	38
PID 2796 wrote to memory of 2928	2796	FedEx_AWB#53052032046.exe	38
PID 2796 wrote to memory of 2564	2796	FedEx_AWB#53052032046.exe	39
PID 2796 wrote to memory of 2564	2796	FedEx_AWB#53052032046.exe	39
PID 2796 wrote to memory of 2564	2796	FedEx_AWB#53052032046.exe	39
PID 2796 wrote to memory of 2564	2796	FedEx_AWB#53052032046.exe	39
PID 2796 wrote to memory of 3000	2796	FedEx_AWB#53052032046.exe	40
PID 2796 wrote to memory of 3000	2796	FedEx_AWB#53052032046.exe	40
PID 2796 wrote to memory of 3000	2796	FedEx_AWB#53052032046.exe	40
PID 2796 wrote to memory of 3000	2796	FedEx_AWB#53052032046.exe	40

C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe
"C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2796
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2748
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\CigPhL.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2600
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\CigPhL" /XML "C:\Users\Admin\AppData\Local\Temp\tmp759D.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2636
- C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe"
  2⤵
  PID:2336
- C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe"
  2⤵
  PID:2144
- C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe"
  2⤵
  PID:2928
- C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe"
  2⤵
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe
  "C:\Users\Admin\AppData\Local\Temp\FedEx_AWB#53052032046.exe"
  2⤵
  PID:3000

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp759D.tmp

Filesize
1KB

MD5
b59a5b16502ceb0c98c7e0584e60232f

SHA1
f0691706d8cde1c7cd198d1364e126af4ebb395f

SHA256
b93346b32e6add7d0a2af92b29649525ac68fc1abd8f28d8ba3d9c94b6e9ec23

SHA512
276ab80d3500d556ae8b4376068b665168a332276be40a2727456f9d746b6b2531409510862c29cd1e1a5013928475a34dec8aca06818caae28255722733267a

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\1L4OT3HZRIO9IDOR5NID.temp

Filesize
7KB

MD5
e1f2184cf4d527e7157e9aa30e0fe80c

SHA1
6add298880d5325d86af1033c784cd84d5e36743

SHA256
60d68ddf1b017be56445d61d72f69a7776504738c1ccba18841b6335e9781931

SHA512
3af75f7688e7f30aa4259993c6fd23dade11e8d9c20e2f14692e0493b8caffdc7edd0296e24b04e85d18eea3e8ba6070c9013b695a7f143a6e9d9b685a6243d1

Download Submit
memory/2796-0-0x000000007496E000-0x000000007496F000-memory.dmp

Filesize
4KB

Download
memory/2796-1-0x0000000000260000-0x00000000002EC000-memory.dmp

Filesize
560KB

Download
memory/2796-2-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2796-3-0x0000000000610000-0x000000000062A000-memory.dmp

Filesize
104KB

Download
memory/2796-4-0x000000007496E000-0x000000007496F000-memory.dmp

Filesize
4KB

Download
memory/2796-5-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download
memory/2796-6-0x0000000000440000-0x000000000044C000-memory.dmp

Filesize
48KB

Download
memory/2796-7-0x0000000000630000-0x0000000000640000-memory.dmp

Filesize
64KB

Download
memory/2796-8-0x0000000005170000-0x00000000051D2000-memory.dmp

Filesize
392KB

Download
memory/2796-21-0x0000000074960000-0x000000007504E000-memory.dmp

Filesize
6.9MB

Download