Analysis
-
max time kernel
118s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
07/09/2024, 17:56
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
20e123d5fc3ce6dd21660e1f2392cbf0N.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
120 seconds
General
-
Target
20e123d5fc3ce6dd21660e1f2392cbf0N.exe
-
Size
986KB
-
MD5
20e123d5fc3ce6dd21660e1f2392cbf0
-
SHA1
a6ffbd3fd7e19546ee81d865682b51760dd5be2d
-
SHA256
531d8e15d9187eb27e839ec544a102d07e6d6e5d2e27a031dca15d48a1d3b748
-
SHA512
8dc7bae683e4b03bb5a42969d901f525f941e0a915c236a0afa4c93735ac522f5c3629158c84948fac0b889e6796eecc67180c6b38898fb4c5b35422dd20cea6
-
SSDEEP
12288:saBSBQnp1K/6exjnarrlZPJgm4g3LHcbcQg6iS3MCFaiECzT+W73sdRTgKz5nJXb:sai/6exjarZNJgm8oQHFaiTt78DraGv
Malware Config
Signatures
-
Looks for VirtualBox Guest Additions in registry 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Oracle\VirtualBox Guest Additions 20e123d5fc3ce6dd21660e1f2392cbf0N.exe -
Looks for VMWare Tools registry key 2 TTPs 1 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\VMware, Inc.\VMware Tools 20e123d5fc3ce6dd21660e1f2392cbf0N.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 20e123d5fc3ce6dd21660e1f2392cbf0N.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 20e123d5fc3ce6dd21660e1f2392cbf0N.exe -
Executes dropped EXE 3 IoCs
pid Process 4680 svchost.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 4976 svchost.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\disk\Enum\0 20e123d5fc3ce6dd21660e1f2392cbf0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 20e123d5fc3ce6dd21660e1f2392cbf0N.exe -
Drops file in Program Files directory 51 IoCs
description ioc Process File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\appvcleaner.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\extcheck.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\idlj.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javap.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jcmd.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jmap.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jconsole.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\IntegratedOffice.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\chrome_proxy.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\chrmstp.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javafxpackager.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zFM.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\Installer\setup.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javadoc.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaw.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdb.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\notification_helper.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jabswitch.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\AppVShNotify.exe svchost.exe File opened for modification C:\Program Files\dotnet\dotnet.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\chrome_pwa_launcher.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7z.exe svchost.exe File opened for modification C:\Program Files\7-Zip\7zG.exe svchost.exe File opened for modification C:\Program Files\Google\Chrome\Application\123.0.6312.123\elevation_service.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\appletviewer.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jar.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jarsigner.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeC2RClient.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\OFFICE16\LICLUA.EXE svchost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\6.0.27\createdump.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java-rmi.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javac.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jinfo.exe svchost.exe File opened for modification C:\Program Files\7-Zip\Uninstall.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\Source Engine\OSE.EXE svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javah.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jps.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\java.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javaws.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\MavInject32.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\javapackager.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jhat.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\ClickToRun\InspectorOfficeGadget.exe svchost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\7.0.16\createdump.exe svchost.exe File opened for modification C:\Program Files\Common Files\microsoft shared\VSTO\10.0\VSTOInstaller.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jdeps.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jjs.exe svchost.exe File opened for modification C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\createdump.exe svchost.exe File opened for modification C:\Program Files\Java\jdk-1.8\bin\jrunscript.exe svchost.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\svchost.exe 20e123d5fc3ce6dd21660e1f2392cbf0N.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20e123d5fc3ce6dd21660e1f2392cbf0N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 20e123d5fc3ce6dd21660e1f2392cbf0N.exe -
Suspicious behavior: EnumeratesProcesses 59 IoCs
pid Process 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 544 20e123d5fc3ce6dd21660e1f2392cbf0N.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1268 wrote to memory of 4680 1268 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 83 PID 1268 wrote to memory of 4680 1268 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 83 PID 1268 wrote to memory of 4680 1268 20e123d5fc3ce6dd21660e1f2392cbf0N.exe 83 PID 4680 wrote to memory of 544 4680 svchost.exe 84 PID 4680 wrote to memory of 544 4680 svchost.exe 84 PID 4680 wrote to memory of 544 4680 svchost.exe 84
Processes
-
C:\Users\Admin\AppData\Local\Temp\20e123d5fc3ce6dd21660e1f2392cbf0N.exe"C:\Users\Admin\AppData\Local\Temp\20e123d5fc3ce6dd21660e1f2392cbf0N.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe" "C:\Users\Admin\AppData\Local\Temp\20e123d5fc3ce6dd21660e1f2392cbf0N.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4680 -
C:\Users\Admin\AppData\Local\Temp\20e123d5fc3ce6dd21660e1f2392cbf0N.exe"C:\Users\Admin\AppData\Local\Temp\20e123d5fc3ce6dd21660e1f2392cbf0N.exe"3⤵
- Looks for VirtualBox Guest Additions in registry
- Looks for VMWare Tools registry key
- Checks BIOS information in registry
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:544
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in Program Files directory
PID:4976
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
951KB
MD571d8fb320a4bb07786255b2f965962c9
SHA16c30a1e8ea32570d76fd3529e799f44d6150adf9
SHA25658b611ddf85878f64703b091b1b6ffbc9794d799118bf8fff9d16752cac0227d
SHA512f40a159951577502dddf287632838afa9c1020a53d818b35f3c362faffb9f75a3bf4316e9e14677888b7110d576e3081aa85fd5de95e255cdb8eab0a8e6b404a
-
Filesize
35KB
MD59e3c13b6556d5636b745d3e466d47467
SHA12ac1c19e268c49bc508f83fe3d20f495deb3e538
SHA25620af03add533a6870d524a7c4753b42bfceb56cddd46016c051e23581ba743f8
SHA5125a07ba8a7fcb15f64b129fada2621252b8bc37eb34d4f614c075c064f8ac0d367301eba0c32c5e28b8aa633f6ab604f0dfcc363b34734ce0207ef0d4e8817c4b