b3e2f66e8a02a8f06188a3170817ea536947fa8efd1958bbdc4b010a46d72c4e

Analysis

max time kernel
93s
max time network
97s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
13-09-2024 04:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d5cee10277b549795819df4e575a0ac0N.exe
Size

17KB
MD5

d5cee10277b549795819df4e575a0ac0
SHA1

1b96094953fb93c55015edc6d8e0552d3ed8c804
SHA256

b3e2f66e8a02a8f06188a3170817ea536947fa8efd1958bbdc4b010a46d72c4e
SHA512

2017ebb485683dee25f9993fb24478d8991154a2760e3bad73d18971809f5810417ebe685f07cbd4564b1892bb9acc7a9c53748a491670e1996ce6919bd38c51
SSDEEP

384:WaWGS6x9zavm80kUj9deEUNjE7+OoxvO2Qx3l76yY:WxN4BaeXU5EaPdO9leyY

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
1676	d5cee10277b549795819df4e575a0ac0N.exe
1676	d5cee10277b549795819df4e575a0ac0N.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\†â„“Ao.dll	d5cee10277b549795819df4e575a0ac0N.exe
File created	C:\Windows\SysWOW64\tf0	d5cee10277b549795819df4e575a0ac0N.exe
File opened for modification	C:\Windows\SysWOW64\†â„“Ao.dll.LoG	d5cee10277b549795819df4e575a0ac0N.exe

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	d5cee10277b549795819df4e575a0ac0N.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\v£Y%‘oÆÀ£YÏyb”iŠP! ´“û˜”˜“Ao†ãÒ“Ao	d5cee10277b549795819df4e575a0ac0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\software	d5cee10277b549795819df4e575a0ac0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion	d5cee10277b549795819df4e575a0ac0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks\	d5cee10277b549795819df4e575a0ac0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\v£Y%‘oÆÀ£YÏyb”iŠP! ´“û˜”˜“Ao†ãÒ“Ao\ = "Microsoft"	d5cee10277b549795819df4e575a0ac0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer	d5cee10277b549795819df4e575a0ac0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\microsoft	d5cee10277b549795819df4e575a0ac0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks	d5cee10277b549795819df4e575a0ac0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\Windows	d5cee10277b549795819df4e575a0ac0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\v£Y%‘oÆÀ£YÏyb”iŠP! ´“û˜”˜“Ao†ãÒ“Ao\InProcServer32	d5cee10277b549795819df4e575a0ac0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\v£Y%‘oÆÀ£YÏyb”iŠP! ´“û˜”˜“Ao†ãÒ“Ao\InProcServer32\ = "C:\\Windows\\SysWow64\\†â„“Ao.dll"	d5cee10277b549795819df4e575a0ac0N.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\v£Y%‘oÆÀ£YÏyb”iŠP! ´“û˜”˜“Ao†ãÒ“Ao\InProcServer32\ThreadingModel = "Apartment"	d5cee10277b549795819df4e575a0ac0N.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\software\microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks	d5cee10277b549795819df4e575a0ac0N.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1676	d5cee10277b549795819df4e575a0ac0N.exe
1676	d5cee10277b549795819df4e575a0ac0N.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	1676	d5cee10277b549795819df4e575a0ac0N.exe
Token: SeRestorePrivilege	1676	d5cee10277b549795819df4e575a0ac0N.exe
Token: SeBackupPrivilege	1676	d5cee10277b549795819df4e575a0ac0N.exe
Token: SeRestorePrivilege	1676	d5cee10277b549795819df4e575a0ac0N.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1676	d5cee10277b549795819df4e575a0ac0N.exe

C:\Users\Admin\AppData\Local\Temp\d5cee10277b549795819df4e575a0ac0N.exe
"C:\Users\Admin\AppData\Local\Temp\d5cee10277b549795819df4e575a0ac0N.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\†â„“Ao.dll

Filesize
206KB

MD5
93288a28453a233efcce26cdae9ed49c

SHA1
84510df6c99050ddb8283aa5b416c5d6f0807c08

SHA256
b5ba03b14a448f1eb181bc84291d97c6c8595e23f540fc19e245717c3d167a81

SHA512
d8d822d12e79b74f42ca8800d49f15f898eabdfc0912721a34013bcce4a0633ca332a58a5c6ad0a734a3b677f2c572bbeb47f71a8315d4f4b29a9dd31c9e9240

Download Submit
memory/1676-4-0x00000000004F0000-0x00000000004FD000-memory.dmp

Filesize
52KB

Download
memory/1676-8-0x00000000004F0000-0x00000000004FD000-memory.dmp

Filesize
52KB

Download