Analysis
-
max time kernel
120s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
09/09/2024, 03:49
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
395bcd2aea2a9af41f2b8ed1955cd440N.exe
Resource
win7-20240708-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
395bcd2aea2a9af41f2b8ed1955cd440N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
395bcd2aea2a9af41f2b8ed1955cd440N.exe
-
Size
524KB
-
MD5
395bcd2aea2a9af41f2b8ed1955cd440
-
SHA1
01b1c2f1c29cd0f678305fa01b76366a04988644
-
SHA256
304d159801ba78dcf1fc1767bab0dadcd9f6f8190171eac9f0593247f93a87df
-
SHA512
1245c0a542981cf253577d581e873b54bb277bd12c567bc14016b64df4ead3c2ab03eeec91e087b2457ef833a982fcac35727e1f2ed441e53ca7f2b61d2064b7
-
SSDEEP
12288:LLS65eo7WOcg3kXaD5Ny6+KW78FCjIwQpe:LLS65eKWOpkXaLy6OECXQpe
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\Control Panel\International\Geo\Nation 395bcd2aea2a9af41f2b8ed1955cd440N.exe -
Executes dropped EXE 2 IoCs
pid Process 1688 WindowsService.exe 4532 WindowsService.exe -
resource yara_rule behavioral2/memory/3972-4-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3972-6-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3972-8-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3972-34-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/3972-44-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral2/memory/4532-47-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-523280732-2327480845-3730041215-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WindowsService = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindowsWindowsService\\WindowsService.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1280 set thread context of 3972 1280 395bcd2aea2a9af41f2b8ed1955cd440N.exe 93 PID 1688 set thread context of 4532 1688 WindowsService.exe 99 PID 1688 set thread context of 0 1688 WindowsService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 395bcd2aea2a9af41f2b8ed1955cd440N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 395bcd2aea2a9af41f2b8ed1955cd440N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe Token: SeDebugPrivilege 4532 WindowsService.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1280 395bcd2aea2a9af41f2b8ed1955cd440N.exe 3972 395bcd2aea2a9af41f2b8ed1955cd440N.exe 1688 WindowsService.exe 4532 WindowsService.exe -
Suspicious use of WriteProcessMemory 25 IoCs
description pid Process procid_target PID 1280 wrote to memory of 3972 1280 395bcd2aea2a9af41f2b8ed1955cd440N.exe 93 PID 1280 wrote to memory of 3972 1280 395bcd2aea2a9af41f2b8ed1955cd440N.exe 93 PID 1280 wrote to memory of 3972 1280 395bcd2aea2a9af41f2b8ed1955cd440N.exe 93 PID 1280 wrote to memory of 3972 1280 395bcd2aea2a9af41f2b8ed1955cd440N.exe 93 PID 1280 wrote to memory of 3972 1280 395bcd2aea2a9af41f2b8ed1955cd440N.exe 93 PID 1280 wrote to memory of 3972 1280 395bcd2aea2a9af41f2b8ed1955cd440N.exe 93 PID 1280 wrote to memory of 3972 1280 395bcd2aea2a9af41f2b8ed1955cd440N.exe 93 PID 1280 wrote to memory of 3972 1280 395bcd2aea2a9af41f2b8ed1955cd440N.exe 93 PID 3972 wrote to memory of 3948 3972 395bcd2aea2a9af41f2b8ed1955cd440N.exe 94 PID 3972 wrote to memory of 3948 3972 395bcd2aea2a9af41f2b8ed1955cd440N.exe 94 PID 3972 wrote to memory of 3948 3972 395bcd2aea2a9af41f2b8ed1955cd440N.exe 94 PID 3948 wrote to memory of 2192 3948 cmd.exe 97 PID 3948 wrote to memory of 2192 3948 cmd.exe 97 PID 3948 wrote to memory of 2192 3948 cmd.exe 97 PID 3972 wrote to memory of 1688 3972 395bcd2aea2a9af41f2b8ed1955cd440N.exe 98 PID 3972 wrote to memory of 1688 3972 395bcd2aea2a9af41f2b8ed1955cd440N.exe 98 PID 3972 wrote to memory of 1688 3972 395bcd2aea2a9af41f2b8ed1955cd440N.exe 98 PID 1688 wrote to memory of 4532 1688 WindowsService.exe 99 PID 1688 wrote to memory of 4532 1688 WindowsService.exe 99 PID 1688 wrote to memory of 4532 1688 WindowsService.exe 99 PID 1688 wrote to memory of 4532 1688 WindowsService.exe 99 PID 1688 wrote to memory of 4532 1688 WindowsService.exe 99 PID 1688 wrote to memory of 4532 1688 WindowsService.exe 99 PID 1688 wrote to memory of 4532 1688 WindowsService.exe 99 PID 1688 wrote to memory of 4532 1688 WindowsService.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\395bcd2aea2a9af41f2b8ed1955cd440N.exe"C:\Users\Admin\AppData\Local\Temp\395bcd2aea2a9af41f2b8ed1955cd440N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Users\Admin\AppData\Local\Temp\395bcd2aea2a9af41f2b8ed1955cd440N.exe"C:\Users\Admin\AppData\Local\Temp\395bcd2aea2a9af41f2b8ed1955cd440N.exe"2⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3972 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\UTFNF.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3948 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsService" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2192
-
-
-
C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:4532
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178B
MD5c2cc427c87f0a6e231266dbb4d5b6ac5
SHA1e0849fc705f915d218b2dc2f744bb24157022355
SHA2561b985a6f00b15b5eb13fd2b9c79f163e2c3ed1b8d4133e08f213dc6dc7850999
SHA512be4d6b172b0c92d1ffa33b30c642db3ccbda637af92234853918ef5e3c6c40121ec10c42557c96ddbc234d0d539c47c6c5adc8bf4c77e9daf8204661215a8e37
-
Filesize
524KB
MD532d8482325c6bc1643956ddd5ee43b56
SHA1023c260b5b10e83867886b36cc94b769086dfe74
SHA2565054b15fb0f90f477110bfd6557266aea9e9876a2b0b7cd0f7b33a8df721a6dc
SHA5124ab8c55d44387c407b486b7bdd249a768e372492a2e58bfdb055c218834c1177b3ce4b699ca27946ca5478278d1a2ae15844613c7f28d635fd5ec97b0368bef2