b4eb06368e1fca2e4527c4ea98f31d691c38eb7311cd49999b2f7ee44c02579a

Analysis

max time kernel
19s
max time network
19s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-09-2024 12:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

NMB Transaction Advice Slip.exe
Size

517KB
MD5

9e441defd7d4ab7e0245ee8a26498deb
SHA1

33da2fbc93355088674e6090ced0fb128476c9c4
SHA256

b145eca67fb85417b21ebc5c779953b0797c62c6b2c01a067f779ba0225d2ae5
SHA512

8a5168eed2725ddd3773c690be4b1576eaec8565623b15da08c67f747c46cdbf98b38306ee152a58de6cbca3bd051080bf56d9e34cf974ef5448df0a1dd6f1b6
SSDEEP

12288:SNxzRKAStqueqGQo/cN9NGxtm3J6Zw49i72lUFkR:MF+qfPQQcQxtm3kw4kE7

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2632	powershell.exe
2668	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	NMB Transaction Advice Slip.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2752	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
1568	NMB Transaction Advice Slip.exe
1568	NMB Transaction Advice Slip.exe
1568	NMB Transaction Advice Slip.exe
1568	NMB Transaction Advice Slip.exe
1568	NMB Transaction Advice Slip.exe
1568	NMB Transaction Advice Slip.exe
1568	NMB Transaction Advice Slip.exe
1568	NMB Transaction Advice Slip.exe
1568	NMB Transaction Advice Slip.exe
1568	NMB Transaction Advice Slip.exe
2632	powershell.exe
2668	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1568	NMB Transaction Advice Slip.exe
Token: SeDebugPrivilege	2632	powershell.exe
Token: SeDebugPrivilege	2668	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 1568 wrote to memory of 2632	1568	NMB Transaction Advice Slip.exe	29
PID 1568 wrote to memory of 2632	1568	NMB Transaction Advice Slip.exe	29
PID 1568 wrote to memory of 2632	1568	NMB Transaction Advice Slip.exe	29
PID 1568 wrote to memory of 2632	1568	NMB Transaction Advice Slip.exe	29
PID 1568 wrote to memory of 2668	1568	NMB Transaction Advice Slip.exe	31
PID 1568 wrote to memory of 2668	1568	NMB Transaction Advice Slip.exe	31
PID 1568 wrote to memory of 2668	1568	NMB Transaction Advice Slip.exe	31
PID 1568 wrote to memory of 2668	1568	NMB Transaction Advice Slip.exe	31
PID 1568 wrote to memory of 2752	1568	NMB Transaction Advice Slip.exe	33
PID 1568 wrote to memory of 2752	1568	NMB Transaction Advice Slip.exe	33
PID 1568 wrote to memory of 2752	1568	NMB Transaction Advice Slip.exe	33
PID 1568 wrote to memory of 2752	1568	NMB Transaction Advice Slip.exe	33
PID 1568 wrote to memory of 2916	1568	NMB Transaction Advice Slip.exe	35
PID 1568 wrote to memory of 2916	1568	NMB Transaction Advice Slip.exe	35
PID 1568 wrote to memory of 2916	1568	NMB Transaction Advice Slip.exe	35
PID 1568 wrote to memory of 2916	1568	NMB Transaction Advice Slip.exe	35
PID 1568 wrote to memory of 2564	1568	NMB Transaction Advice Slip.exe	36
PID 1568 wrote to memory of 2564	1568	NMB Transaction Advice Slip.exe	36
PID 1568 wrote to memory of 2564	1568	NMB Transaction Advice Slip.exe	36
PID 1568 wrote to memory of 2564	1568	NMB Transaction Advice Slip.exe	36
PID 1568 wrote to memory of 3068	1568	NMB Transaction Advice Slip.exe	37
PID 1568 wrote to memory of 3068	1568	NMB Transaction Advice Slip.exe	37
PID 1568 wrote to memory of 3068	1568	NMB Transaction Advice Slip.exe	37
PID 1568 wrote to memory of 3068	1568	NMB Transaction Advice Slip.exe	37
PID 1568 wrote to memory of 2676	1568	NMB Transaction Advice Slip.exe	38
PID 1568 wrote to memory of 2676	1568	NMB Transaction Advice Slip.exe	38
PID 1568 wrote to memory of 2676	1568	NMB Transaction Advice Slip.exe	38
PID 1568 wrote to memory of 2676	1568	NMB Transaction Advice Slip.exe	38
PID 1568 wrote to memory of 2712	1568	NMB Transaction Advice Slip.exe	39
PID 1568 wrote to memory of 2712	1568	NMB Transaction Advice Slip.exe	39
PID 1568 wrote to memory of 2712	1568	NMB Transaction Advice Slip.exe	39
PID 1568 wrote to memory of 2712	1568	NMB Transaction Advice Slip.exe	39

C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe
"C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1568
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2632
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\fKgSvnyq.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2668
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\fKgSvnyq" /XML "C:\Users\Admin\AppData\Local\Temp\tmp512C.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2752
- C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe
  "C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe"
  2⤵
  PID:2916
- C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe
  "C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe"
  2⤵
  PID:2564
- C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe
  "C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe"
  2⤵
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe
  "C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe"
  2⤵
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe
  "C:\Users\Admin\AppData\Local\Temp\NMB Transaction Advice Slip.exe"
  2⤵
  PID:2712

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp512C.tmp

Filesize
1KB

MD5
3349a15b670218f5116d9cf7cf01e457

SHA1
e0ac6aa13963b28af75071474a138d512abe64d8

SHA256
ac2cbf678b90c5856554f804a0264e0c4808721dc6671155e87d475125b223b2

SHA512
0468888b94057275185a71ec4566b3e21902a6001c59e88e9716ad281fc41e4573522b47fd3c06fa8318317d180a811fff81d0811dfc1099cf08981ff10677fa

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
b921ab2471be2771d5dcb35449b4107f

SHA1
a569afd1fbccb39c871b1b59062e23deb72b2a8f

SHA256
8f6237dd72b8205a26333c3e1accf4d763e9447b097da6dcce4663966cfc64a5

SHA512
48686d367dbd4f513ac6ce4eac626a738cb5c867a968c2c5e174968954ccda1782b0c201703dfc5aed97f5cf50051c4ce12ca84374a2660142cdc29e2031abe3

Download Submit
memory/1568-0-0x000000007471E000-0x000000007471F000-memory.dmp

Filesize
4KB

Download
memory/1568-1-0x00000000003C0000-0x0000000000444000-memory.dmp

Filesize
528KB

Download
memory/1568-2-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1568-3-0x0000000000340000-0x0000000000350000-memory.dmp

Filesize
64KB

Download
memory/1568-4-0x000000007471E000-0x000000007471F000-memory.dmp

Filesize
4KB

Download
memory/1568-5-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download
memory/1568-6-0x0000000004330000-0x0000000004392000-memory.dmp

Filesize
392KB

Download
memory/1568-19-0x0000000074710000-0x0000000074DFE000-memory.dmp

Filesize
6.9MB

Download