Analysis
-
max time kernel
124s -
max time network
129s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
25-09-2024 09:42
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe
Resource
win7-20240729-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe
-
Size
159KB
-
MD5
70e0ec444e51ea02174ec13c02a9fb26
-
SHA1
69ece913a8597d55722bad0f3c311da368923c6b
-
SHA256
d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382
-
SHA512
e018598c1c0728ba81c5fea4c4f36864f195643d82236859ecb5031752df368b3eea81bb675a7784b2a0c7c537f65f0d7d1adccad4424433d757eee318b623fb
-
SSDEEP
3072:xkY4k28GEHx1UG2c0IsWnR3FPy+3ZiA/kIKeI6+zCPLBNecbPdB+XGSlZ51Jd4+X:x3U8GER27c0ArBl/E6o4LBNecUeul
Score
3/10
Malware Config
Signatures
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language whoami.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WMIC.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language systeminfo.exe -
Gathers network information 2 TTPs 1 IoCs
Uses commandline utility to view network configuration.
pid Process 4512 ipconfig.exe -
Gathers system information 1 TTPs 1 IoCs
Runs systeminfo.exe.
pid Process 768 systeminfo.exe -
Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 4932 whoami.exe Token: SeIncreaseQuotaPrivilege 2156 WMIC.exe Token: SeSecurityPrivilege 2156 WMIC.exe Token: SeTakeOwnershipPrivilege 2156 WMIC.exe Token: SeLoadDriverPrivilege 2156 WMIC.exe Token: SeSystemProfilePrivilege 2156 WMIC.exe Token: SeSystemtimePrivilege 2156 WMIC.exe Token: SeProfSingleProcessPrivilege 2156 WMIC.exe Token: SeIncBasePriorityPrivilege 2156 WMIC.exe Token: SeCreatePagefilePrivilege 2156 WMIC.exe Token: SeBackupPrivilege 2156 WMIC.exe Token: SeRestorePrivilege 2156 WMIC.exe Token: SeShutdownPrivilege 2156 WMIC.exe Token: SeDebugPrivilege 2156 WMIC.exe Token: SeSystemEnvironmentPrivilege 2156 WMIC.exe Token: SeRemoteShutdownPrivilege 2156 WMIC.exe Token: SeUndockPrivilege 2156 WMIC.exe Token: SeManageVolumePrivilege 2156 WMIC.exe Token: 33 2156 WMIC.exe Token: 34 2156 WMIC.exe Token: 35 2156 WMIC.exe Token: 36 2156 WMIC.exe Token: SeIncreaseQuotaPrivilege 2156 WMIC.exe Token: SeSecurityPrivilege 2156 WMIC.exe Token: SeTakeOwnershipPrivilege 2156 WMIC.exe Token: SeLoadDriverPrivilege 2156 WMIC.exe Token: SeSystemProfilePrivilege 2156 WMIC.exe Token: SeSystemtimePrivilege 2156 WMIC.exe Token: SeProfSingleProcessPrivilege 2156 WMIC.exe Token: SeIncBasePriorityPrivilege 2156 WMIC.exe Token: SeCreatePagefilePrivilege 2156 WMIC.exe Token: SeBackupPrivilege 2156 WMIC.exe Token: SeRestorePrivilege 2156 WMIC.exe Token: SeShutdownPrivilege 2156 WMIC.exe Token: SeDebugPrivilege 2156 WMIC.exe Token: SeSystemEnvironmentPrivilege 2156 WMIC.exe Token: SeRemoteShutdownPrivilege 2156 WMIC.exe Token: SeUndockPrivilege 2156 WMIC.exe Token: SeManageVolumePrivilege 2156 WMIC.exe Token: 33 2156 WMIC.exe Token: 34 2156 WMIC.exe Token: 35 2156 WMIC.exe Token: 36 2156 WMIC.exe -
Suspicious use of WriteProcessMemory 30 IoCs
description pid Process procid_target PID 436 wrote to memory of 3920 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 90 PID 436 wrote to memory of 3920 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 90 PID 436 wrote to memory of 3920 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 90 PID 3920 wrote to memory of 4932 3920 cmd.exe 91 PID 3920 wrote to memory of 4932 3920 cmd.exe 91 PID 3920 wrote to memory of 4932 3920 cmd.exe 91 PID 436 wrote to memory of 1828 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 92 PID 436 wrote to memory of 1828 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 92 PID 436 wrote to memory of 1828 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 92 PID 1828 wrote to memory of 4512 1828 cmd.exe 93 PID 1828 wrote to memory of 4512 1828 cmd.exe 93 PID 1828 wrote to memory of 4512 1828 cmd.exe 93 PID 436 wrote to memory of 4412 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 94 PID 436 wrote to memory of 4412 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 94 PID 436 wrote to memory of 4412 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 94 PID 436 wrote to memory of 4284 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 95 PID 436 wrote to memory of 4284 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 95 PID 436 wrote to memory of 4284 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 95 PID 4284 wrote to memory of 2156 4284 cmd.exe 96 PID 4284 wrote to memory of 2156 4284 cmd.exe 96 PID 4284 wrote to memory of 2156 4284 cmd.exe 96 PID 436 wrote to memory of 4024 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 98 PID 436 wrote to memory of 4024 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 98 PID 436 wrote to memory of 4024 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 98 PID 4024 wrote to memory of 768 4024 cmd.exe 99 PID 4024 wrote to memory of 768 4024 cmd.exe 99 PID 4024 wrote to memory of 768 4024 cmd.exe 99 PID 436 wrote to memory of 2996 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 101 PID 436 wrote to memory of 2996 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 101 PID 436 wrote to memory of 2996 436 d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe"C:\Users\Admin\AppData\Local\Temp\d469101177f6bf36c38755988485c255e2918304ad51d30b5ed76062a4e46382.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:436 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c whoami2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3920 -
C:\Windows\SysWOW64\whoami.exewhoami3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:4932
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ipconfig /all2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1828 -
C:\Windows\SysWOW64\ipconfig.exeipconfig /all3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:4512
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo %USERPROFILE%\Desktop2⤵
- System Location Discovery: System Language Discovery
PID:4412
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c wmic diskdrive get serialnumber2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4284 -
C:\Windows\SysWOW64\Wbem\WMIC.exewmic diskdrive get serialnumber3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:2156
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c systeminfo2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4024 -
C:\Windows\SysWOW64\systeminfo.exesysteminfo3⤵
- System Location Discovery: System Language Discovery
- Gathers system information
PID:768
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c dir C:\Users\Admin\\Desktop2⤵
- System Location Discovery: System Language Discovery
PID:2996
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4444,i,6510295916244954942,10164894160290787457,262144 --variations-seed-version --mojo-platform-channel-handle=4112 /prefetch:81⤵PID:3624