d40c675daf5891dba4cf5ed2fe44e779065fe430694e2f52f9fc60b62936a48e

Analysis

max time kernel
110s
max time network
138s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
08/09/2024, 02:48

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d40c675daf5891dba4cf5ed2fe44e779065fe430694e2f52f9fc60b62936a48e.exe
Size

1.4MB
MD5

e3a8a29b466706a3a4e2381f2fb5e03f
SHA1

ec828aafb29fb669b93a583390632c5227b485ea
SHA256

d40c675daf5891dba4cf5ed2fe44e779065fe430694e2f52f9fc60b62936a48e
SHA512

608800e4e2f135f4959aab38834f36ae2b88ab80ca94b4e12ebd886389d3aa1bf4dfe2a93e8158e30f7c1939340d691201f91bc4675f5d407e7cb58248eb6458
SSDEEP

24576:NaQNjMNIxNs4VLOhlJxqPEou5L6zIQ5gu2v7Z8YsRphicTmBxQqpBYS3DK7/lTOF:Na4LdoJxqcX5syL1Lihit7QQBYS3Dw/e

Score

7^/10

discovery

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4092	~260uu8mtf6.tmp

Use of msiexec (install) with remote resource 1 IoCs

pid	Process
388	MSIEXEC.EXE

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d40c675daf5891dba4cf5ed2fe44e779065fe430694e2f52f9fc60b62936a48e.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	~260uu8mtf6.tmp
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	MSIEXEC.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	388	MSIEXEC.EXE
Token: SeIncreaseQuotaPrivilege	388	MSIEXEC.EXE

Suspicious use of FindShellTrayWindow 2 IoCs

pid	Process
388	MSIEXEC.EXE
388	MSIEXEC.EXE

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 664 wrote to memory of 4092	664	d40c675daf5891dba4cf5ed2fe44e779065fe430694e2f52f9fc60b62936a48e.exe	85
PID 664 wrote to memory of 4092	664	d40c675daf5891dba4cf5ed2fe44e779065fe430694e2f52f9fc60b62936a48e.exe	85
PID 664 wrote to memory of 4092	664	d40c675daf5891dba4cf5ed2fe44e779065fe430694e2f52f9fc60b62936a48e.exe	85
PID 4092 wrote to memory of 388	4092	~260uu8mtf6.tmp	89
PID 4092 wrote to memory of 388	4092	~260uu8mtf6.tmp	89
PID 4092 wrote to memory of 388	4092	~260uu8mtf6.tmp	89

C:\Users\Admin\AppData\Local\Temp\d40c675daf5891dba4cf5ed2fe44e779065fe430694e2f52f9fc60b62936a48e.exe
"C:\Users\Admin\AppData\Local\Temp\d40c675daf5891dba4cf5ed2fe44e779065fe430694e2f52f9fc60b62936a48e.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:664
- C:\Users\Admin\AppData\Local\Temp\~260uu8mtf6.tmp
  "C:\Users\Admin\AppData\Local\Temp\~260uu8mtf6.tmp"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4092
- - C:\Windows\SysWOW64\MSIEXEC.EXE
    MSIEXEC.EXE /i "http://pliuht.cdnpckgs.eu/client/pkgs/slotveg/Slots of Vegas20160607071316.msi" DDC_DID=1489315 DDC_RTGURL=http://www.setupdlh.com/dl/TrackSetup/TrackSetup.aspx?DID=1489315 DDC_UPDATESTATUSURL=http://190.4.94.8:8080/slotveg/Lobby.WebServices/Installer.asmx DDC_SIGNUPURL=http://190.4.94.8:8080/slotveg/Lobby.WebSite/SignUpUnsecure.aspx SETUPEXEDIR="C:\Users\Admin\AppData\Local\Temp" SETUPEXENAME="~260uu8mtf6.tmp"
    3⤵
    - Use of msiexec (install) with remote resource
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of FindShellTrayWindow
    PID:388

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\_isC5E5.tmp

Filesize
1KB

MD5
90047faa93c88aa027dd2638bbca3fa6

SHA1
f434abf1386ac1ddd9f2b6bb3eaf03b49455111f

SHA256
20a2b33ccc45b87097b92f5eb3bc8ae11d18f9169aad52d2d61bf6c09c491669

SHA512
ca51aea3ecc5aebc4b5fed51e6f9a3ec0a67032e8c8d1333fb1f9bfaeb58ed697f548b7050f4ec3a20e99baa19b2bd4ecabb62e24acef71c092e6ff047793965

Download Submit
C:\Users\Admin\AppData\Local\Temp\{CE057FD9-F9B3-4C7D-9200-B3418C89D128}\0x0409.ini

Filesize
21KB

MD5
be345d0260ae12c5f2f337b17e07c217

SHA1
0976ba0982fe34f1c35a0974f6178e15c238ed7b

SHA256
e994689a13b9448c074f9b471edeec9b524890a0d82925e98ab90b658016d8f3

SHA512
77040dbee29be6b136a83b9e444d8b4f71ff739f7157e451778fb4fccb939a67ff881a70483de16bcb6ae1fea64a89e00711a33ec26f4d3eea8e16c9e9553eff

Download Submit
C:\Users\Admin\AppData\Local\Temp\{CE057FD9-F9B3-4C7D-9200-B3418C89D128}\_ISMSIDEL.INI

Filesize
20B

MD5
db9af7503f195df96593ac42d5519075

SHA1
1b487531bad10f77750b8a50aca48593379e5f56

SHA256
0a33c5dffabcf31a1f6802026e9e2eef4b285e57fd79d52fdcd98d6502d14b13

SHA512
6839264e14576fe190260a4b82afc11c88e50593a20113483851bf4abfdb7cca9986bef83f4c6b8f98ef4d426f07024cf869e8ab393df6d2b743b9b8e2544e1b

Download Submit
C:\Users\Admin\AppData\Local\Temp\~260uu8mtf6.tmp

Filesize
1.2MB

MD5
2c056b3ae2f696432b23e33d45266b1d

SHA1
dac32e76c02d6ca45928ed8072c7b66bb9e4a20c

SHA256
8597aea7166b68621b389b2ebed68cc4973a79ff22ca3399b089d4da54668771

SHA512
ccbe71464e0b0bcbcb075ea629bd943a1a0adbe518d5c5cdf89ccf872137939af380ecfd7ffa70f0a6de8d8000859e3169c9a6f15a192251087c70ad0ccebd60

Download Submit
C:\Users\Admin\AppData\Local\Temp\~C5D2.tmp

Filesize
5KB

MD5
cea28ca56c2235d48e9cfd44d9588bba

SHA1
35fb644d682c0dbcd20dfb13d6f2ce6ba0eaba4f

SHA256
252b417884bc9e69bc9b4270a14675998daf38976810e598de152a2c1cd12e7f

SHA512
1782bbc1216a1f00e1e0dc650fdd2cf7ee008ca366ad59d21b729b33347ecdfaa63bc2f895e89197684bc9b09ab5a7c673dcf0a3af5dc3bfdea4ef9da7c668ab

Download Submit