fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395

General

Target

fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe
Size

2.9MB
MD5

0abd203d9ec724e158734da542e64c70
SHA1

dcccc0e6a914b8ba691927688a8253e971e8f748
SHA256

fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395
SHA512

b3fbed17bf68fffc650a5f61d1e4ebc4b3ae28f6c8e6f87d24d4a7c402ab7bf366b832464859f536edc5490f7216b7717e9fa1fc0cb8371c910f42a10c10f1a2
SSDEEP

49152:8oj1u70WR2bmhesmSozsd1Ou+GxCt9h4aNvmpqy/iWlgC:1MRLhehS/4uutXFNvm0yqWH

Score

8^/10

execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2024	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-945322488-2060912225-3527527000-1000\Control Panel\International\Geo\Nation	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apscit.exe.lnk	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe

Executes dropped EXE 1 IoCs

pid	Process
2584	apscit.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Delays execution with timeout.exe 1 IoCs

evasion

pid	Process
768	timeout.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
4144	schtasks.exe

Suspicious behavior: AddClipboardFormatListener 1 IoCs

pid	Process
2584	apscit.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2024	powershell.exe
2024	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3368	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe
Token: SeDebugPrivilege	2024	powershell.exe
Token: SeDebugPrivilege	2584	apscit.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3368 wrote to memory of 2024	3368	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	84
PID 3368 wrote to memory of 2024	3368	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	84
PID 3368 wrote to memory of 4144	3368	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	85
PID 3368 wrote to memory of 4144	3368	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	85
PID 3368 wrote to memory of 2584	3368	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	88
PID 3368 wrote to memory of 2584	3368	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	88
PID 3368 wrote to memory of 1148	3368	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	89
PID 3368 wrote to memory of 1148	3368	fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe	89
PID 1148 wrote to memory of 768	1148	cmd.exe	91
PID 1148 wrote to memory of 768	1148	cmd.exe	91

Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
persistence

Query Registry
T1012

C:\Users\Admin\AppData\Local\Temp\fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe
"C:\Users\Admin\AppData\Local\Temp\fbf9cc2f5fe0522f2394337952cf8794b39794569641a9c96758e43942d09395N.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3368
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" Add-MpPreference -ExclusionPath 'C:\ProgramData\ACCApi'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2024
- C:\Windows\SYSTEM32\schtasks.exe
  "schtasks.exe" /create /tn AccSys /tr "C:\ProgramData\ACCApi\apscit.exe" /st 06:39 /du 23:59 /sc daily /ri 1 /f
  2⤵
  - Scheduled Task/Job: Scheduled Task
  PID:4144
- C:\ProgramData\ACCApi\apscit.exe
  "C:\ProgramData\ACCApi\apscit.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: AddClipboardFormatListener
  - Suspicious use of AdjustPrivilegeToken
  PID:2584
- C:\Windows\system32\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.cmd""
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1148
- - C:\Windows\system32\timeout.exe
    timeout 6
    3⤵
    - Delays execution with timeout.exe
    PID:768

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

2

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\ACCApi\apscit.exe

Filesize
3.4MB

MD5
a99b90813fa535f10fb85dc8f79e687b

SHA1
6a67dfa960e790d6f0bda8fb50cfcc1807eac05f

SHA256
877be30afa67754921babbed11c59739a0d7ff11ed0a12f830e8953161fd48d1

SHA512
fb2ada23f62006c9881943772a7c93f370e5cffc0046f062a7fb6e31fe946943f755079b1cb216ecd688651d8fd9eb378594bd9bb2de52f7724cf085d4a19c87

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_0bklwn00.t04.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tmpBF87.tmp.cmd

Filesize
217B

MD5
941ea41f6e0d98b54b535e7f782fb7b9

SHA1
0657f4f942b35eec21e081be48eb0064cd639b8f

SHA256
2608e5c3c0298bd21252e5e4b37c8a80ed328bea11a343a84695a532c1d2a0b0

SHA512
19fa6b2b68c6c0ea1402bf2074b5eab8fd354950562fda36fc8d0f8e5925c1e96d62f38b67492b76004064fc2474ae705b9dec4d5f6287d762044c4f8300dcaa

Download Submit
memory/2024-22-0x00000269D08B0000-0x00000269D08D2000-memory.dmp

Filesize
136KB

Download
memory/2024-26-0x00007FFF68250000-0x00007FFF68D11000-memory.dmp

Filesize
10.8MB

Download
memory/2024-30-0x00007FFF68250000-0x00007FFF68D11000-memory.dmp

Filesize
10.8MB

Download
memory/2024-31-0x00007FFF68250000-0x00007FFF68D11000-memory.dmp

Filesize
10.8MB

Download
memory/2024-35-0x00007FFF68250000-0x00007FFF68D11000-memory.dmp

Filesize
10.8MB

Download
memory/3368-0-0x00007FFF68253000-0x00007FFF68255000-memory.dmp

Filesize
8KB

Download
memory/3368-1-0x000001C3528C0000-0x000001C352938000-memory.dmp

Filesize
480KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads