79718c9a132edd51dcdf6d2bd558b21b76a910707860e4a669e17c7a142140f0

Analysis

max time kernel
17s
max time network
18s
platform
windows7_x64
resource
win7-20240705-en
resource tags

arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system
submitted
26/08/2024, 05:20

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

aa7158bb4698b05c1860ae1cb987c460N.exe
Size

18KB
MD5

aa7158bb4698b05c1860ae1cb987c460
SHA1

61b20e76619a9cb064b46860639b33ebacfa0a0b
SHA256

79718c9a132edd51dcdf6d2bd558b21b76a910707860e4a669e17c7a142140f0
SHA512

b436b4dcaae74922ff1899e10dd2e70e37d7b48b122de39edfaf6456f0c00cad2e4c1e595e919b4fba835fe60af53822c0fdd8852cb7bc21d748088b02c90d17
SSDEEP

192:w2kZNgXfD4zbrR5Fhp8cdwpHR3AkPLiM79mLU2PcSKhcum:ZwN+4Z5FZdgAkTiM79mgLJcum

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1576	b2e.exe

Loads dropped DLL 2 IoCs

pid	Process
2124	aa7158bb4698b05c1860ae1cb987c460N.exe
2124	aa7158bb4698b05c1860ae1cb987c460N.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa7158bb4698b05c1860ae1cb987c460N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
2676	PING.EXE
1456	PING.EXE
2620	PING.EXE
2672	PING.EXE
2644	PING.EXE
2624	PING.EXE
824	PING.EXE
3008	PING.EXE
2844	PING.EXE
2256	PING.EXE
2532	PING.EXE
2352	PING.EXE
2724	PING.EXE
2536	PING.EXE

Kills process with taskkill 1 IoCs

evasion

pid	Process
2312	taskkill.exe

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
3008	PING.EXE
2644	PING.EXE
1456	PING.EXE
2620	PING.EXE
2536	PING.EXE
2672	PING.EXE
2676	PING.EXE
2724	PING.EXE
2844	PING.EXE
2624	PING.EXE
2532	PING.EXE
824	PING.EXE
2352	PING.EXE
2256	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2312	taskkill.exe
Token: SeShutdownPrivilege	2052	shutdown.exe
Token: SeRemoteShutdownPrivilege	2052	shutdown.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2124 wrote to memory of 1576	2124	aa7158bb4698b05c1860ae1cb987c460N.exe	30
PID 2124 wrote to memory of 1576	2124	aa7158bb4698b05c1860ae1cb987c460N.exe	30
PID 2124 wrote to memory of 1576	2124	aa7158bb4698b05c1860ae1cb987c460N.exe	30
PID 2124 wrote to memory of 1576	2124	aa7158bb4698b05c1860ae1cb987c460N.exe	30
PID 1576 wrote to memory of 2980	1576	b2e.exe	31
PID 1576 wrote to memory of 2980	1576	b2e.exe	31
PID 1576 wrote to memory of 2980	1576	b2e.exe	31
PID 1576 wrote to memory of 2980	1576	b2e.exe	31
PID 2980 wrote to memory of 3008	2980	cmd.exe	33
PID 2980 wrote to memory of 3008	2980	cmd.exe	33
PID 2980 wrote to memory of 3008	2980	cmd.exe	33
PID 2980 wrote to memory of 3008	2980	cmd.exe	33
PID 2980 wrote to memory of 2724	2980	cmd.exe	34
PID 2980 wrote to memory of 2724	2980	cmd.exe	34
PID 2980 wrote to memory of 2724	2980	cmd.exe	34
PID 2980 wrote to memory of 2724	2980	cmd.exe	34
PID 2980 wrote to memory of 2844	2980	cmd.exe	35
PID 2980 wrote to memory of 2844	2980	cmd.exe	35
PID 2980 wrote to memory of 2844	2980	cmd.exe	35
PID 2980 wrote to memory of 2844	2980	cmd.exe	35
PID 2980 wrote to memory of 2620	2980	cmd.exe	36
PID 2980 wrote to memory of 2620	2980	cmd.exe	36
PID 2980 wrote to memory of 2620	2980	cmd.exe	36
PID 2980 wrote to memory of 2620	2980	cmd.exe	36
PID 2980 wrote to memory of 2644	2980	cmd.exe	37
PID 2980 wrote to memory of 2644	2980	cmd.exe	37
PID 2980 wrote to memory of 2644	2980	cmd.exe	37
PID 2980 wrote to memory of 2644	2980	cmd.exe	37
PID 2980 wrote to memory of 2672	2980	cmd.exe	38
PID 2980 wrote to memory of 2672	2980	cmd.exe	38
PID 2980 wrote to memory of 2672	2980	cmd.exe	38
PID 2980 wrote to memory of 2672	2980	cmd.exe	38
PID 2980 wrote to memory of 2536	2980	cmd.exe	39
PID 2980 wrote to memory of 2536	2980	cmd.exe	39
PID 2980 wrote to memory of 2536	2980	cmd.exe	39
PID 2980 wrote to memory of 2536	2980	cmd.exe	39
PID 2980 wrote to memory of 2676	2980	cmd.exe	40
PID 2980 wrote to memory of 2676	2980	cmd.exe	40
PID 2980 wrote to memory of 2676	2980	cmd.exe	40
PID 2980 wrote to memory of 2676	2980	cmd.exe	40
PID 2980 wrote to memory of 2624	2980	cmd.exe	41
PID 2980 wrote to memory of 2624	2980	cmd.exe	41
PID 2980 wrote to memory of 2624	2980	cmd.exe	41
PID 2980 wrote to memory of 2624	2980	cmd.exe	41
PID 2980 wrote to memory of 2532	2980	cmd.exe	42
PID 2980 wrote to memory of 2532	2980	cmd.exe	42
PID 2980 wrote to memory of 2532	2980	cmd.exe	42
PID 2980 wrote to memory of 2532	2980	cmd.exe	42
PID 2980 wrote to memory of 1456	2980	cmd.exe	43
PID 2980 wrote to memory of 1456	2980	cmd.exe	43
PID 2980 wrote to memory of 1456	2980	cmd.exe	43
PID 2980 wrote to memory of 1456	2980	cmd.exe	43
PID 2980 wrote to memory of 824	2980	cmd.exe	44
PID 2980 wrote to memory of 824	2980	cmd.exe	44
PID 2980 wrote to memory of 824	2980	cmd.exe	44
PID 2980 wrote to memory of 824	2980	cmd.exe	44
PID 2980 wrote to memory of 2352	2980	cmd.exe	45
PID 2980 wrote to memory of 2352	2980	cmd.exe	45
PID 2980 wrote to memory of 2352	2980	cmd.exe	45
PID 2980 wrote to memory of 2352	2980	cmd.exe	45
PID 2980 wrote to memory of 2256	2980	cmd.exe	46
PID 2980 wrote to memory of 2256	2980	cmd.exe	46
PID 2980 wrote to memory of 2256	2980	cmd.exe	46
PID 2980 wrote to memory of 2256	2980	cmd.exe	46

C:\Users\Admin\AppData\Local\Temp\aa7158bb4698b05c1860ae1cb987c460N.exe
"C:\Users\Admin\AppData\Local\Temp\aa7158bb4698b05c1860ae1cb987c460N.exe"
1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2124
- C:\Users\Admin\AppData\Local\Temp\C16B.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\C16B.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\C16B.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\aa7158bb4698b05c1860ae1cb987c460N.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1576
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\C1C9.tmp\batchfile.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 3000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3008
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2724
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 3500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2844
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 200
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2620
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 1000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2644
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2672
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2536
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2676
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2624
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2532
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 1500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1456
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 5000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:824
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 10000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2352
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2256
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /f /im explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:2312
  - - C:\Windows\SysWOW64\shutdown.exe
      SHUTDOWN -s -t 15
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:2052

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:1356

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2364

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\C1C9.tmp\batchfile.bat

Filesize
1KB

MD5
a89fe2bd53189c02d174cb568663a1a1

SHA1
6222e1696ef9f1ef2139f7f85d4a09f8280c1891

SHA256
e9426a80107b4fdbfbf97eeb2f08f29f8c7fd30ee36cc7810726d2ff41baf33f

SHA512
ef158abb712de1952a34eb4d2d4549160798ae5349df2b28daf2f4e0351f020aab37cfd19a28524fde6945ed69e3f43bb2f0d307d9b05cc4a9fd4483406f363f

Download Submit
\Users\Admin\AppData\Local\Temp\C16B.tmp\b2e.exe

Filesize
10KB

MD5
91bdc25a839ca0c79b25737c9892f9b1

SHA1
2b2ee358cd63d3f1e0eeffab47ee37e500fd9889

SHA256
a5fafc595fc6720b776beb4d527f7a865b3631d3b9ad8d7eb26b6768e9ef9028

SHA512
7b9dea06f65163d57664b1ebbc3343693774b9134928a48427340c48019ef5660e96e4372f93097cab6406a6d075349363334e89cdd386bf0c0501e40cf87949

Download Submit
memory/1576-14-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/1576-31-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2124-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/2124-5-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download
memory/2124-8-0x00000000002D0000-0x00000000002D5000-memory.dmp

Filesize
20KB

Download
memory/2124-13-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads