79718c9a132edd51dcdf6d2bd558b21b76a910707860e4a669e17c7a142140f0

Analysis

max time kernel
20s
max time network
21s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
26/08/2024, 05:20

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

aa7158bb4698b05c1860ae1cb987c460N.exe
Size

18KB
MD5

aa7158bb4698b05c1860ae1cb987c460
SHA1

61b20e76619a9cb064b46860639b33ebacfa0a0b
SHA256

79718c9a132edd51dcdf6d2bd558b21b76a910707860e4a669e17c7a142140f0
SHA512

b436b4dcaae74922ff1899e10dd2e70e37d7b48b122de39edfaf6456f0c00cad2e4c1e595e919b4fba835fe60af53822c0fdd8852cb7bc21d748088b02c90d17
SSDEEP

192:w2kZNgXfD4zbrR5Fhp8cdwpHR3AkPLiM79mLU2PcSKhcum:ZwN+4Z5FZdgAkTiM79mgLJcum

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	aa7158bb4698b05c1860ae1cb987c460N.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2392887640-1187051047-2909758433-1000\Control Panel\International\Geo\Nation	b2e.exe

Executes dropped EXE 1 IoCs

pid	Process
2952	b2e.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 19 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	shutdown.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	aa7158bb4698b05c1860ae1cb987c460N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	b2e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PING.EXE

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 14 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

pid	Process
4104	PING.EXE
3576	PING.EXE
3732	PING.EXE
4436	PING.EXE
1880	PING.EXE
2640	PING.EXE
2276	PING.EXE
1304	PING.EXE
1472	PING.EXE
1556	PING.EXE
2784	PING.EXE
2108	PING.EXE
1732	PING.EXE
4964	PING.EXE

Kills process with taskkill 1 IoCs

evasion

pid	Process
3044	taskkill.exe

Modifies data under HKEY_USERS 15 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationBlurBalance = "1"	LogonUI.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentPalette = a6d8ff0076b9ed00429ce3000078d700005a9e000042750000264200f7630c00	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\AccentColorMenu = "4292311040"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColor = "3288365271"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationGlassAttribute = "1"	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent	LogonUI.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglowBalance = "10"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\EnableWindowColorization = "237"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Themes\History\AutoColor = "0"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Explorer\Accent\StartColorMenu = "4288567808"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\AccentColor = "4292311040"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationColorBalance = "89"	LogonUI.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\DWM\ColorizationAfterglow = "3288365271"	LogonUI.exe

Runs ping.exe 1 TTPs 14 IoCs

Remote System Discovery

T1018

pid	Process
3576	PING.EXE
2640	PING.EXE
2276	PING.EXE
4104	PING.EXE
2108	PING.EXE
1472	PING.EXE
2784	PING.EXE
3732	PING.EXE
1732	PING.EXE
4436	PING.EXE
1880	PING.EXE
1556	PING.EXE
4964	PING.EXE
1304	PING.EXE

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3044	taskkill.exe
Token: SeShutdownPrivilege	3772	shutdown.exe
Token: SeRemoteShutdownPrivilege	3772	shutdown.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1268	LogonUI.exe

Suspicious use of WriteProcessMemory 54 IoCs

description	pid	Process	procid_target
PID 3016 wrote to memory of 2952	3016	aa7158bb4698b05c1860ae1cb987c460N.exe	84
PID 3016 wrote to memory of 2952	3016	aa7158bb4698b05c1860ae1cb987c460N.exe	84
PID 3016 wrote to memory of 2952	3016	aa7158bb4698b05c1860ae1cb987c460N.exe	84
PID 2952 wrote to memory of 4092	2952	b2e.exe	85
PID 2952 wrote to memory of 4092	2952	b2e.exe	85
PID 2952 wrote to memory of 4092	2952	b2e.exe	85
PID 4092 wrote to memory of 4104	4092	cmd.exe	89
PID 4092 wrote to memory of 4104	4092	cmd.exe	89
PID 4092 wrote to memory of 4104	4092	cmd.exe	89
PID 4092 wrote to memory of 2108	4092	cmd.exe	91
PID 4092 wrote to memory of 2108	4092	cmd.exe	91
PID 4092 wrote to memory of 2108	4092	cmd.exe	91
PID 4092 wrote to memory of 1880	4092	cmd.exe	92
PID 4092 wrote to memory of 1880	4092	cmd.exe	92
PID 4092 wrote to memory of 1880	4092	cmd.exe	92
PID 4092 wrote to memory of 1472	4092	cmd.exe	94
PID 4092 wrote to memory of 1472	4092	cmd.exe	94
PID 4092 wrote to memory of 1472	4092	cmd.exe	94
PID 4092 wrote to memory of 3576	4092	cmd.exe	95
PID 4092 wrote to memory of 3576	4092	cmd.exe	95
PID 4092 wrote to memory of 3576	4092	cmd.exe	95
PID 4092 wrote to memory of 2640	4092	cmd.exe	96
PID 4092 wrote to memory of 2640	4092	cmd.exe	96
PID 4092 wrote to memory of 2640	4092	cmd.exe	96
PID 4092 wrote to memory of 3732	4092	cmd.exe	97
PID 4092 wrote to memory of 3732	4092	cmd.exe	97
PID 4092 wrote to memory of 3732	4092	cmd.exe	97
PID 4092 wrote to memory of 2276	4092	cmd.exe	98
PID 4092 wrote to memory of 2276	4092	cmd.exe	98
PID 4092 wrote to memory of 2276	4092	cmd.exe	98
PID 4092 wrote to memory of 1556	4092	cmd.exe	99
PID 4092 wrote to memory of 1556	4092	cmd.exe	99
PID 4092 wrote to memory of 1556	4092	cmd.exe	99
PID 4092 wrote to memory of 2784	4092	cmd.exe	100
PID 4092 wrote to memory of 2784	4092	cmd.exe	100
PID 4092 wrote to memory of 2784	4092	cmd.exe	100
PID 4092 wrote to memory of 1732	4092	cmd.exe	101
PID 4092 wrote to memory of 1732	4092	cmd.exe	101
PID 4092 wrote to memory of 1732	4092	cmd.exe	101
PID 4092 wrote to memory of 4964	4092	cmd.exe	102
PID 4092 wrote to memory of 4964	4092	cmd.exe	102
PID 4092 wrote to memory of 4964	4092	cmd.exe	102
PID 4092 wrote to memory of 1304	4092	cmd.exe	103
PID 4092 wrote to memory of 1304	4092	cmd.exe	103
PID 4092 wrote to memory of 1304	4092	cmd.exe	103
PID 4092 wrote to memory of 4436	4092	cmd.exe	104
PID 4092 wrote to memory of 4436	4092	cmd.exe	104
PID 4092 wrote to memory of 4436	4092	cmd.exe	104
PID 4092 wrote to memory of 3044	4092	cmd.exe	105
PID 4092 wrote to memory of 3044	4092	cmd.exe	105
PID 4092 wrote to memory of 3044	4092	cmd.exe	105
PID 4092 wrote to memory of 3772	4092	cmd.exe	107
PID 4092 wrote to memory of 3772	4092	cmd.exe	107
PID 4092 wrote to memory of 3772	4092	cmd.exe	107

C:\Users\Admin\AppData\Local\Temp\aa7158bb4698b05c1860ae1cb987c460N.exe
"C:\Users\Admin\AppData\Local\Temp\aa7158bb4698b05c1860ae1cb987c460N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3016
- C:\Users\Admin\AppData\Local\Temp\9D2A.tmp\b2e.exe
  "C:\Users\Admin\AppData\Local\Temp\9D2A.tmp\b2e.exe" C:\Users\Admin\AppData\Local\Temp\9D2A.tmp\b2e.exe C:\Users\Admin\AppData\Local\Temp "C:\Users\Admin\AppData\Local\Temp\aa7158bb4698b05c1860ae1cb987c460N.exe"
  2⤵
  - Checks computer location settings
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:2952
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\9E72.tmp\batchfile.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4092
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 3000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4104
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2108
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 3500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1880
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 200
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1472
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 1000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3576
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2640
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:3732
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2276
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1556
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:2784
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 1500
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1732
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 5000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4964
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 10000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:1304
  - - C:\Windows\SysWOW64\PING.EXE
      PING 1.1.1.1 -n 1 -w 2000
      4⤵
      System Location Discovery: System Language Discovery
      System Network Configuration Discovery: Internet Connection Discovery
      Runs ping.exe
      PID:4436
  - - C:\Windows\SysWOW64\taskkill.exe
      TASKKILL /f /im explorer.exe
      4⤵
      System Location Discovery: System Language Discovery
      Kills process with taskkill
      Suspicious use of AdjustPrivilegeToken
      PID:3044
  - - C:\Windows\SysWOW64\shutdown.exe
      SHUTDOWN -s -t 15
      4⤵
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3772

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x4 /state0:0xa3957855 /state1:0x41c64e6d
1⤵
- Modifies data under HKEY_USERS
- Suspicious use of SetWindowsHookEx
PID:1268

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\9D2A.tmp\b2e.exe

Filesize
10KB

MD5
91bdc25a839ca0c79b25737c9892f9b1

SHA1
2b2ee358cd63d3f1e0eeffab47ee37e500fd9889

SHA256
a5fafc595fc6720b776beb4d527f7a865b3631d3b9ad8d7eb26b6768e9ef9028

SHA512
7b9dea06f65163d57664b1ebbc3343693774b9134928a48427340c48019ef5660e96e4372f93097cab6406a6d075349363334e89cdd386bf0c0501e40cf87949

Download Submit
C:\Users\Admin\AppData\Local\Temp\9E72.tmp\batchfile.bat

Filesize
1KB

MD5
a89fe2bd53189c02d174cb568663a1a1

SHA1
6222e1696ef9f1ef2139f7f85d4a09f8280c1891

SHA256
e9426a80107b4fdbfbf97eeb2f08f29f8c7fd30ee36cc7810726d2ff41baf33f

SHA512
ef158abb712de1952a34eb4d2d4549160798ae5349df2b28daf2f4e0351f020aab37cfd19a28524fde6945ed69e3f43bb2f0d307d9b05cc4a9fd4483406f363f

Download Submit
memory/2952-8-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/2952-16-0x0000000000400000-0x0000000000405000-memory.dmp

Filesize
20KB

Download
memory/3016-0-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download
memory/3016-11-0x0000000000400000-0x0000000000407000-memory.dmp

Filesize
28KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads