Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-09-2024 08:17
Static task
static1
Behavioral task
behavioral1
Sample
74b63fc7533ba2dfd75253a2ac5044f9.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
74b63fc7533ba2dfd75253a2ac5044f9.exe
Resource
win10v2004-20240802-en
General
-
Target
74b63fc7533ba2dfd75253a2ac5044f9.exe
-
Size
752KB
-
MD5
74b63fc7533ba2dfd75253a2ac5044f9
-
SHA1
20c6f4f4db0e850f1506e7d89be267f2fa1b21e2
-
SHA256
fbcceeb087e972ef29b0e3561a022aa4e6897cd78de77049e130e47bafcde554
-
SHA512
ff82f9a7138fce1aca1c59fd0fc7b050d59a5c507af33beb599bec543b7b3c8186a7e7ece3c8aa47ef5383d115b06231e80bffc398598764fd642a7228e23bb1
-
SSDEEP
12288:nXJaAf3gv3zDtlZcqY18aAV0uyXVU62+eqvIwLT6Q11m14VELQrr+ZuHu/bf95Ro:5aO3gvjs8JV0uyXE1w/K6ELDuO/J5e
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1728 74b63fc7533ba2dfd75253a2ac5044f9.exe -
pid Process 2480 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 74b63fc7533ba2dfd75253a2ac5044f9.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2480 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2480 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1728 wrote to memory of 2480 1728 74b63fc7533ba2dfd75253a2ac5044f9.exe 30 PID 1728 wrote to memory of 2480 1728 74b63fc7533ba2dfd75253a2ac5044f9.exe 30 PID 1728 wrote to memory of 2480 1728 74b63fc7533ba2dfd75253a2ac5044f9.exe 30 PID 1728 wrote to memory of 2480 1728 74b63fc7533ba2dfd75253a2ac5044f9.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\74b63fc7533ba2dfd75253a2ac5044f9.exe"C:\Users\Admin\AppData\Local\Temp\74b63fc7533ba2dfd75253a2ac5044f9.exe"1⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle minimized "$Paleolith179=Get-Content 'C:\Users\Admin\AppData\Roaming\Fastlggende246\Ytringsfriheds.Boe';$Scob=$Paleolith179.SubString(55585,3);.$Scob($Paleolith179)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2480
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
6KB
MD57f4a854abf13869f8b0f3c8952a1d4b0
SHA141c1dc531094abb81e5c37a04e7b88da14dd3980
SHA256971b9daea9ad21621ac81776c13fdd899979ab920fed44c9066a41f60b961a4c
SHA512df775a146adb801659bfec3921cf66975c8fa1425c66081ac168dc6294151d4a05c0c478d3d86fb445176bc7e775bd0165e8900d4354783ecdb9fab58a612dbe