8b8b106d00671b48d72df517885e1c8444fc01d2072af30f304680e619c0a0dd

Analysis

max time kernel
96s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
09/09/2024, 09:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
Nowe zamwienie.exe
Size 17KB
Sample240909-lehm1a1drj
SHA256 8239559d5c986284031b5918e229e63e61ea790e35cd1e972241bd3ff36b5087
MD5 e1a906c8e061756213b4745e769a86db
SHA1 a5a3af63dc82bbfc302f9b3471e6115e2d456056
SHA512 8e2e64c4376ad2059ebb31d9d2d7612b19de4520de69094d96375d1ba020319230d6687811bf359511498a9204af5df47649b9e820c9deb50e0862d805cc2545
SSDEEP 384:visr/4fP4+g0az4F/4PI2zAybVofffFGdD:aWeWzAAvdD
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

agilenet discovery persistence

Malware Config

Signatures

Obfuscated with Agile.Net obfuscator 1 IoCs

Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.

agilenet

resource	yara_rule
behavioral2/memory/1332-10-0x00000000066F0000-0x00000000067A4000-memory.dmp	agile_net

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-786284298-625481688-3210388970-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Nowe zamwienie = "C:\\Users\\Admin\\Documents\\Nowe zam\uefa2wienie.pif"	reg.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1332 set thread context of 4556	1332	Nowe zamwienie.exe	98

System Location Discovery: System Language Discovery 1 TTPs 5 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	RegAsm.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Nowe zamwienie.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious behavior: EnumeratesProcesses 37 IoCs

pid	Process
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
1332	Nowe zamwienie.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe
4556	RegAsm.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1332	Nowe zamwienie.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 3148	1332	Nowe zamwienie.exe	93
PID 1332 wrote to memory of 3148	1332	Nowe zamwienie.exe	93
PID 1332 wrote to memory of 3148	1332	Nowe zamwienie.exe	93
PID 3148 wrote to memory of 3992	3148	cmd.exe	95
PID 3148 wrote to memory of 3992	3148	cmd.exe	95
PID 3148 wrote to memory of 3992	3148	cmd.exe	95
PID 1332 wrote to memory of 620	1332	Nowe zamwienie.exe	96
PID 1332 wrote to memory of 620	1332	Nowe zamwienie.exe	96
PID 1332 wrote to memory of 620	1332	Nowe zamwienie.exe	96
PID 1332 wrote to memory of 4556	1332	Nowe zamwienie.exe	98
PID 1332 wrote to memory of 4556	1332	Nowe zamwienie.exe	98
PID 1332 wrote to memory of 4556	1332	Nowe zamwienie.exe	98
PID 1332 wrote to memory of 4556	1332	Nowe zamwienie.exe	98
PID 1332 wrote to memory of 4556	1332	Nowe zamwienie.exe	98
PID 1332 wrote to memory of 4556	1332	Nowe zamwienie.exe	98

C:\Users\Admin\AppData\Local\Temp\Nowe zamwienie.exe
"C:\Users\Admin\AppData\Local\Temp\Nowe zamwienie.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1332
- C:\Windows\SysWOW64\cmd.exe
  cmd /c REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Nowe zamwienie" /t REG_SZ /F /D "C:\Users\Admin\Documents\Nowe zamwienie.pif"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3148
- - C:\Windows\SysWOW64\reg.exe
    REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Nowe zamwienie" /t REG_SZ /F /D "C:\Users\Admin\Documents\Nowe zamwienie.pif"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:3992
- C:\Windows\SysWOW64\cmd.exe
  cmd /c Copy "C:\Users\Admin\AppData\Local\Temp\Nowe zamwienie.exe" "C:\Users\Admin\Documents\Nowe zamwienie.pif"
  2⤵
  - System Location Discovery: System Language Discovery
  PID:620
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  PID:4556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1332-8-0x0000000006420000-0x000000000643E000-memory.dmp

Download

memory/1332-10-0x00000000066F0000-0x00000000067A4000-memory.dmp

Download

memory/1332-2-0x00000000057B0000-0x0000000005D54000-memory.dmp

Download

memory/1332-3-0x0000000005300000-0x0000000005392000-memory.dmp

Download

memory/1332-4-0x0000000005420000-0x0000000005496000-memory.dmp

Download

memory/1332-5-0x00000000747E0000-0x0000000074F90000-memory.dmp

Download

memory/1332-6-0x00000000747EE000-0x00000000747EF000-memory.dmp

Download

memory/1332-7-0x00000000747E0000-0x0000000074F90000-memory.dmp

Download

memory/1332-1-0x0000000000910000-0x000000000091A000-memory.dmp

Download

memory/1332-0-0x00000000747EE000-0x00000000747EF000-memory.dmp

Download

memory/1332-9-0x00000000066E0000-0x00000000066EA000-memory.dmp

Download

memory/1332-11-0x0000000006850000-0x00000000068EC000-memory.dmp

Download

memory/1332-12-0x00000000069F0000-0x0000000006A56000-memory.dmp

Download

memory/1332-17-0x00000000747E0000-0x0000000074F90000-memory.dmp

Download

memory/4556-15-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4556-18-0x0000000000400000-0x0000000000446000-memory.dmp

Download

memory/4556-19-0x0000000002E60000-0x00000000031AA000-memory.dmp

Download

memory/4556-20-0x0000000000400000-0x0000000000446000-memory.dmp

Download