bf992ac4db39eda600480f333c3f4daa2b0e5889f6e1f3970db946e012e73ceb

Analysis

max time kernel
111s
max time network
104s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
24/08/2024, 19:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9ccd79f698c02cbb1d394d3047515330N.exe
Size

67KB
MD5

9ccd79f698c02cbb1d394d3047515330
SHA1

2e3baa085506046bec730682e834b406697cea2b
SHA256

bf992ac4db39eda600480f333c3f4daa2b0e5889f6e1f3970db946e012e73ceb
SHA512

7c0fd045b761cb572869767230482791c231fdf5a51ba2912a76961659839ad257c3ae295d261d9b28c253f8f5ffdb7e65bd0f4c8d282419de1598653bee0952
SSDEEP

768:ZrItKyw5WHXfQIhIiIk9ecAaVPD96KyX6+LLL8cccpPPPPq:Zr3Z5IfQIR81ad5yX6FcccpPPPPq

Score

8^/10

defense_evasion discovery evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
3804	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation	9ccd79f698c02cbb1d394d3047515330N.exe

Executes dropped EXE 1 IoCs

pid	Process
2956	akmhost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\Debug\akmhost.exe	9ccd79f698c02cbb1d394d3047515330N.exe
File opened for modification	C:\Windows\Debug\akmhost.exe	attrib.exe
File created	C:\Windows\Debug\akmhost.exe	9ccd79f698c02cbb1d394d3047515330N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9ccd79f698c02cbb1d394d3047515330N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	akmhost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	948	9ccd79f698c02cbb1d394d3047515330N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 948 wrote to memory of 3804	948	9ccd79f698c02cbb1d394d3047515330N.exe	84
PID 948 wrote to memory of 3804	948	9ccd79f698c02cbb1d394d3047515330N.exe	84
PID 948 wrote to memory of 3804	948	9ccd79f698c02cbb1d394d3047515330N.exe	84
PID 948 wrote to memory of 2500	948	9ccd79f698c02cbb1d394d3047515330N.exe	90
PID 948 wrote to memory of 2500	948	9ccd79f698c02cbb1d394d3047515330N.exe	90
PID 948 wrote to memory of 2500	948	9ccd79f698c02cbb1d394d3047515330N.exe	90

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3804	attrib.exe

C:\Users\Admin\AppData\Local\Temp\9ccd79f698c02cbb1d394d3047515330N.exe
"C:\Users\Admin\AppData\Local\Temp\9ccd79f698c02cbb1d394d3047515330N.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:948
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\akmhost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:3804
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\9CCD79~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2500

C:\Windows\Debug\akmhost.exe
C:\Windows\Debug\akmhost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2956

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\akmhost.exe

Filesize
67KB

MD5
6e945ba8bf3e680434b24423f40a83b9

SHA1
0a9b6abcc5802808368153e5f0cde1824d495e57

SHA256
2dc4aeb510ab86e9ad6731ab211c17050ed60f60958deb06e0b80cd147753d2f

SHA512
464e12d886a3c321516ddf856300d60e9117e7791c49f414d843b92cb1af8dbe3e267bf908c6e0b3fda2ced29b672de6dc24ffe5dc3dbc0f8918e984aadc960f

Download Submit
memory/948-0-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/948-5-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download
memory/2956-6-0x0000000000400000-0x0000000000411000-memory.dmp

Filesize
68KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads