775fa9dd265c0f37e11ac0f524516d566e1c7998552ab3a463ae7dabae988ece

Analysis

max time kernel
113s
max time network
107s
platform
windows11-21h2_x64
resource
win11-20240802-en
resource tags

arch:x64arch:x86image:win11-20240802-enlocale:en-usos:windows11-21h2-x64system
submitted
06-09-2024 18:46

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

setup.exe
Size

2.5MB
MD5

e2606134f5ebabcc69ecd0ec2d8df29d
SHA1

e7cfc2194d9ed72264a0949734c9167a97fa200d
SHA256

775fa9dd265c0f37e11ac0f524516d566e1c7998552ab3a463ae7dabae988ece
SHA512

f3d5ba18d5a55b2491ee946a43a07c350a4b14d4a5f236638734d1954679eab97cc2bc82cff626043853abc7fc93164ef3b23fc0d78b5dbd707b47400b4924e7
SSDEEP

49152:yEdED2TlnfPnFNzBjCwOkkgKJEvwvKqeJF34ffLCfJZCJieQCQeQ6Nt28ojK:yHEnfPtpOEIvqqLqCyCQer728P

Score

8^/10

discovery evasion execution persistence

Malware Config

Signatures

Creates new service(s) 2 TTPs
persistence execution

Windows Service
T1543.003

Service Execution
T1569.002
Stops running service(s) 4 TTPs
evasion execution

Windows Service
T1543.003

Impair Defenses
T1562

Service Stop
T1489

Service Execution
T1569.002

Executes dropped EXE 1 IoCs

pid	Process
1100	SystemFile64.exe

Loads dropped DLL 13 IoCs

pid	Process
2352	setup.exe
2352	setup.exe
2352	setup.exe
2352	setup.exe
2352	setup.exe
2352	setup.exe
2352	setup.exe
2352	setup.exe
2352	setup.exe
2352	setup.exe
2352	setup.exe
2352	setup.exe
2352	setup.exe

Drops file in Windows directory 5 IoCs

description	ioc	Process
File created	C:\Windows\SystemFile64.exe	setup.exe
File created	C:\Windows\7zip.exe	SystemFile64.exe
File opened for modification	C:\Windows\parameters.ini	SystemFile64.exe
File created	C:\Windows\parameters.ini	setup.exe
File created	C:\Windows\relent-list.txt	setup.exe

Launches sc.exe 4 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
72	sc.exe
4252	sc.exe
620	sc.exe
700	sc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 16 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	setup.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	SystemFile64.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	sc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2352	setup.exe
2352	setup.exe
2352	setup.exe
2352	setup.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1100	SystemFile64.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1100	SystemFile64.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 2352 wrote to memory of 428	2352	setup.exe	78
PID 2352 wrote to memory of 428	2352	setup.exe	78
PID 2352 wrote to memory of 428	2352	setup.exe	78
PID 428 wrote to memory of 5012	428	cmd.exe	80
PID 428 wrote to memory of 5012	428	cmd.exe	80
PID 428 wrote to memory of 5012	428	cmd.exe	80
PID 5012 wrote to memory of 2792	5012	net.exe	81
PID 5012 wrote to memory of 2792	5012	net.exe	81
PID 5012 wrote to memory of 2792	5012	net.exe	81
PID 2352 wrote to memory of 840	2352	setup.exe	82
PID 2352 wrote to memory of 840	2352	setup.exe	82
PID 2352 wrote to memory of 840	2352	setup.exe	82
PID 840 wrote to memory of 72	840	cmd.exe	84
PID 840 wrote to memory of 72	840	cmd.exe	84
PID 840 wrote to memory of 72	840	cmd.exe	84
PID 2352 wrote to memory of 4168	2352	setup.exe	85
PID 2352 wrote to memory of 4168	2352	setup.exe	85
PID 2352 wrote to memory of 4168	2352	setup.exe	85
PID 4168 wrote to memory of 4252	4168	cmd.exe	87
PID 4168 wrote to memory of 4252	4168	cmd.exe	87
PID 4168 wrote to memory of 4252	4168	cmd.exe	87
PID 2352 wrote to memory of 4436	2352	setup.exe	88
PID 2352 wrote to memory of 4436	2352	setup.exe	88
PID 2352 wrote to memory of 4436	2352	setup.exe	88
PID 4436 wrote to memory of 620	4436	cmd.exe	90
PID 4436 wrote to memory of 620	4436	cmd.exe	90
PID 4436 wrote to memory of 620	4436	cmd.exe	90
PID 2352 wrote to memory of 1160	2352	setup.exe	91
PID 2352 wrote to memory of 1160	2352	setup.exe	91
PID 2352 wrote to memory of 1160	2352	setup.exe	91
PID 1160 wrote to memory of 700	1160	cmd.exe	93
PID 1160 wrote to memory of 700	1160	cmd.exe	93
PID 1160 wrote to memory of 700	1160	cmd.exe	93
PID 2352 wrote to memory of 1584	2352	setup.exe	94
PID 2352 wrote to memory of 1584	2352	setup.exe	94
PID 2352 wrote to memory of 1584	2352	setup.exe	94
PID 1584 wrote to memory of 2980	1584	cmd.exe	96
PID 1584 wrote to memory of 2980	1584	cmd.exe	96
PID 1584 wrote to memory of 2980	1584	cmd.exe	96
PID 2980 wrote to memory of 2020	2980	net.exe	97
PID 2980 wrote to memory of 2020	2980	net.exe	97
PID 2980 wrote to memory of 2020	2980	net.exe	97

C:\Users\Admin\AppData\Local\Temp\setup.exe
"C:\Users\Admin\AppData\Local\Temp\setup.exe"
1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2352
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C net stop SystemFile64
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:428
- - C:\Windows\SysWOW64\net.exe
    net stop SystemFile64
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:5012
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop SystemFile64
      4⤵
      System Location Discovery: System Language Discovery
      PID:2792
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C Sc delete SystemFile64
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:840
- - C:\Windows\SysWOW64\sc.exe
    Sc delete SystemFile64
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:72
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C Sc create SystemFile64 binpath= C:\Windows\SystemFile64.exe start= auto DisplayName= SystemFile64
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4168
- - C:\Windows\SysWOW64\sc.exe
    Sc create SystemFile64 binpath= C:\Windows\SystemFile64.exe start= auto DisplayName= SystemFile64
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:4252
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C sc description SystemFile64 SystemFileService
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4436
- - C:\Windows\SysWOW64\sc.exe
    sc description SystemFile64 SystemFileService
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:620
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C sc failure SystemFile64 reset= 3600 actions= restart/60000/restart/60000/restart/60000
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\sc.exe
    sc failure SystemFile64 reset= 3600 actions= restart/60000/restart/60000/restart/60000
    3⤵
    - Launches sc.exe
    - System Location Discovery: System Language Discovery
    PID:700
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /C net start SystemFile64
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1584
- - C:\Windows\SysWOW64\net.exe
    net start SystemFile64
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2980
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 start SystemFile64
      4⤵
      System Location Discovery: System Language Discovery
      PID:2020

C:\Windows\SystemFile64.exe
C:\Windows\SystemFile64.exe
1⤵
- Executes dropped EXE
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1100

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

System Services

T1569

Service Execution

T1569.002

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Impair Defenses

T1562

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Service Stop

T1489

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\nsa7A61.tmp\nsExec.dll

Filesize
6KB

MD5
b5a1f9dc73e2944a388a61411bdd8c70

SHA1
dc9b20df3f3810c2e81a0c54dea385704ba8bef7

SHA256
288100583f65a2b7acfc0c7e231c0e268c58d3067675543f627c01e82f6fd884

SHA512
b9c8d71b5da00f2aff7847b9ec3bd8a588afeb525f47a0df235b52f7b2233edb3928a2c8e0b493f287c923cc52a340ad6fee99822595d6591df0e97870de92a8

Download Submit
C:\Users\Admin\AppData\Local\Temp\nsa7A61.tmp\nsProcess.dll

Filesize
4KB

MD5
05450face243b3a7472407b999b03a72

SHA1
ffd88af2e338ae606c444390f7eaaf5f4aef2cd9

SHA256
95fe9d92512ff2318cc2520311ef9145b2cee01209ab0e1b6e45c7ce1d4d0e89

SHA512
f4cbe30166aff20a226a7150d93a876873ba699d80d7e9f46f32a9b4753fa7966c3113a3124340b39ca67a13205463a413e740e541e742903e3f89af5a53ad3b

Download Submit
C:\Windows\SystemFile64.exe

Filesize
5.9MB

MD5
1d7c380a28a428b67b72bcb7d1c28d6c

SHA1
3f00a6e1e95f09690456ee8e1ae05d3964432fa4

SHA256
76db8fea5dc386cfbac67340744ad57e6f50589918b3762eb6c92dfb39cf8588

SHA512
587c9282718672526eb6401ec9f5b899a6538ca9748cac5c044b41d4e786ce18a84d81b092cf522c89103566176c13be0a3c76aa75f9801fbc3fa78eb3856f61

Download Submit
C:\Windows\parameters.ini

Filesize
259B

MD5
2cb047d1f9a6eb25ef1b26b2a599342e

SHA1
1a9985a8d2c229c6944e523843cdd97b4f4e4e7e

SHA256
7a901f8fb6dd310b2b701d4a30d58d11896786ebcac23c5d374b1ff15cf3de7d

SHA512
8a21587cc6598dbc39989e41fedc2f56b9db0adebc517768b17e0093828b765a373256c013aaf73fa3221e760c9058577134571994167c45371dd52c1a5e89a1

Download Submit
C:\Windows\relent-list.txt

Filesize
133B

MD5
fed33cdc3c6c7f509572124039c4ec82

SHA1
3b816927442927a4b1cefbc11fdb9e0b81bec0d7

SHA256
38e85452b03215d40752f48d61067fc469297ea531f4b56ce156d09977b804b3

SHA512
abcb0f677c35e498cec79ed74a4f25a22decd2d193e6f680bed384fbded3ee811c920e59e0172a9ecc411bb7adc1b5beba563c253f7f6002b034d59ad85d9daf

Download Submit
memory/1100-67-0x00000000004C0000-0x0000000000AD5000-memory.dmp

Filesize
6.1MB

Download
memory/1100-65-0x00000000004C0000-0x0000000000AD5000-memory.dmp

Filesize
6.1MB

Download
memory/1100-66-0x00000000004C0000-0x0000000000AD5000-memory.dmp

Filesize
6.1MB

Download
memory/1100-64-0x00000000004C0000-0x0000000000AD5000-memory.dmp

Filesize
6.1MB

Download
memory/1100-68-0x00000000004C0000-0x0000000000AD5000-memory.dmp

Filesize
6.1MB

Download
memory/1100-69-0x00000000004C0000-0x0000000000AD5000-memory.dmp

Filesize
6.1MB

Download
memory/1100-70-0x00000000004C0000-0x0000000000AD5000-memory.dmp

Filesize
6.1MB

Download
memory/1100-71-0x00000000004C0000-0x0000000000AD5000-memory.dmp

Filesize
6.1MB

Download
memory/1100-72-0x00000000004C0000-0x0000000000AD5000-memory.dmp

Filesize
6.1MB

Download
memory/1100-73-0x00000000004C0000-0x0000000000AD5000-memory.dmp

Filesize
6.1MB

Download
memory/1100-74-0x00000000004C0000-0x0000000000AD5000-memory.dmp

Filesize
6.1MB

Download