207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856

Analysis

max time kernel
111s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
19-09-2024 06:56

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe
Size

63KB
MD5

a5626f25977c7b66e20ffd8429e7ed40
SHA1

7b8914fab6d7cb6a96542bde2c171aa6339e73cf
SHA256

207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856
SHA512

51ea9a269a75623cea22412b8274fc5c1329257f581d70dbe755d22c79eea78d80a49559ac412b2a6eef0c9269cd09aa025822ea61c798acc03cf382d50ed474
SSDEEP

768:MDcpEBMLfQcubV5wGE96YyXDTLdEBBBB9:MDcfLfIbtEbyXfZE

Score

8^/10

defense_evasion discovery evasion

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

pid	Process
1708	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe

Executes dropped EXE 1 IoCs

pid	Process
3516	foohost.exe

Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\Debug\foohost.exe	207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe
File opened for modification	C:\Windows\Debug\foohost.exe	207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe
File opened for modification	C:\Windows\Debug\foohost.exe	attrib.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	foohost.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	4424	207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 4424 wrote to memory of 1708	4424	207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe	82
PID 4424 wrote to memory of 1708	4424	207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe	82
PID 4424 wrote to memory of 1708	4424	207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe	82
PID 4424 wrote to memory of 4860	4424	207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe	85
PID 4424 wrote to memory of 4860	4424	207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe	85
PID 4424 wrote to memory of 4860	4424	207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe	85

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
1708	attrib.exe

C:\Users\Admin\AppData\Local\Temp\207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe
"C:\Users\Admin\AppData\Local\Temp\207143c22a9b04bb19838d6a2320af955d7ae619f792ac64f539551d6d762856N.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4424
- C:\Windows\SysWOW64\attrib.exe
  attrib +a +s +h +r C:\Windows\Debug\foohost.exe
  2⤵
  - Sets file to hidden
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:1708
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\207143~1.EXE > nul
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4860

C:\Windows\Debug\foohost.exe
C:\Windows\Debug\foohost.exe
1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3516

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Debug\foohost.exe

Filesize
63KB

MD5
b1b8fa360085e3f98fbd34f2fbb3b54a

SHA1
17d59374dbaf5bcd42d7dc758c1ad7640da52ab5

SHA256
8af3db559e39a54108b64f68772a265d67979f17d2bab3eb50cb0f2f8b0be768

SHA512
7b0300c34e96140badc3288ce5f8a106e9800a7e8a1de0ba7c6127a0b51cb3d13ccc1c74c65cc9ae53dedf116ef39eee670488e390d567bfd8b321affa8b2b78

Download Submit

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads