17647852d0cdce2aae192bc3709b93fc028c274b3253c2b9cf03e22b37789d90

Analysis

max time kernel
94s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
28/09/2024, 05:01

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

17647852d0cdce2aae192bc3709b93fc028c274b3253c2b9cf03e22b37789d90N.exe
Size

185KB
MD5

f2b20e5ae6941e7dad2bf09c532eb740
SHA1

418a6a0c4579335f541edd6c3b725f6656387e65
SHA256

17647852d0cdce2aae192bc3709b93fc028c274b3253c2b9cf03e22b37789d90
SHA512

1a3b9c73475db71bddaa26e837e8c531272a44fdbba4c77aa09f6aa3823ed6c2cd74f2b8dc12088af385afc2333f66b3a801136f34e8e0ef276516c8d0aca172
SSDEEP

3072:C7cWbk8outfL9f9sm2IyF4yrA/HDZFZhHNbAZ:CFRoSf5f4/c97hHN

Score

8^/10

discovery evasion persistence privilege_escalation upx

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
2340	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1302416131-1437503476-2806442725-1000\Control Panel\International\Geo\Nation	17647852d0cdce2aae192bc3709b93fc028c274b3253c2b9cf03e22b37789d90N.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft_Office = "C:\\Windows\\word.exe -hide"	reg.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\sms.exe	cmd.exe
File opened for modification	C:\Windows\SysWOW64\sms.exe	cmd.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3272-0-0x0000000000400000-0x0000000000464000-memory.dmp	upx
behavioral2/memory/3272-9-0x0000000000400000-0x0000000000464000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\word.exe	cmd.exe
File opened for modification	C:\Windows\word.exe	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 14 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	taskkill.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	17647852d0cdce2aae192bc3709b93fc028c274b3253c2b9cf03e22b37789d90N.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Kills process with taskkill 1 IoCs

evasion

pid	Process
2488	taskkill.exe

Runs net.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2488	taskkill.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 3272 wrote to memory of 4792	3272	17647852d0cdce2aae192bc3709b93fc028c274b3253c2b9cf03e22b37789d90N.exe	82
PID 3272 wrote to memory of 4792	3272	17647852d0cdce2aae192bc3709b93fc028c274b3253c2b9cf03e22b37789d90N.exe	82
PID 3272 wrote to memory of 4792	3272	17647852d0cdce2aae192bc3709b93fc028c274b3253c2b9cf03e22b37789d90N.exe	82
PID 4792 wrote to memory of 2300	4792	cmd.exe	85
PID 4792 wrote to memory of 2300	4792	cmd.exe	85
PID 4792 wrote to memory of 2300	4792	cmd.exe	85
PID 4792 wrote to memory of 1492	4792	cmd.exe	86
PID 4792 wrote to memory of 1492	4792	cmd.exe	86
PID 4792 wrote to memory of 1492	4792	cmd.exe	86
PID 1492 wrote to memory of 2032	1492	net.exe	87
PID 1492 wrote to memory of 2032	1492	net.exe	87
PID 1492 wrote to memory of 2032	1492	net.exe	87
PID 4792 wrote to memory of 3800	4792	cmd.exe	88
PID 4792 wrote to memory of 3800	4792	cmd.exe	88
PID 4792 wrote to memory of 3800	4792	cmd.exe	88
PID 3800 wrote to memory of 2016	3800	net.exe	89
PID 3800 wrote to memory of 2016	3800	net.exe	89
PID 3800 wrote to memory of 2016	3800	net.exe	89
PID 4792 wrote to memory of 2340	4792	cmd.exe	90
PID 4792 wrote to memory of 2340	4792	cmd.exe	90
PID 4792 wrote to memory of 2340	4792	cmd.exe	90
PID 4792 wrote to memory of 4596	4792	cmd.exe	91
PID 4792 wrote to memory of 4596	4792	cmd.exe	91
PID 4792 wrote to memory of 4596	4792	cmd.exe	91
PID 4596 wrote to memory of 1644	4596	net.exe	92
PID 4596 wrote to memory of 1644	4596	net.exe	92
PID 4596 wrote to memory of 1644	4596	net.exe	92
PID 4792 wrote to memory of 2368	4792	cmd.exe	93
PID 4792 wrote to memory of 2368	4792	cmd.exe	93
PID 4792 wrote to memory of 2368	4792	cmd.exe	93
PID 2368 wrote to memory of 4568	2368	net.exe	94
PID 2368 wrote to memory of 4568	2368	net.exe	94
PID 2368 wrote to memory of 4568	2368	net.exe	94
PID 4792 wrote to memory of 2488	4792	cmd.exe	95
PID 4792 wrote to memory of 2488	4792	cmd.exe	95
PID 4792 wrote to memory of 2488	4792	cmd.exe	95
PID 4792 wrote to memory of 3128	4792	cmd.exe	97
PID 4792 wrote to memory of 3128	4792	cmd.exe	97
PID 4792 wrote to memory of 3128	4792	cmd.exe	97

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

pid	Process
3128	attrib.exe

C:\Users\Admin\AppData\Local\Temp\17647852d0cdce2aae192bc3709b93fc028c274b3253c2b9cf03e22b37789d90N.exe
"C:\Users\Admin\AppData\Local\Temp\17647852d0cdce2aae192bc3709b93fc028c274b3253c2b9cf03e22b37789d90N.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3272
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\A057.tmp\y.bat" "C:\Users\Admin\AppData\Local\Temp\""
  2⤵
  - Drops file in System32 directory
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:4792
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /v Microsoft_Office /t REG_SZ /d "C:\Windows\word.exe -hide"
    3⤵
    - Adds Run key to start application
    - System Location Discovery: System Language Discovery
    PID:2300
- - C:\Windows\SysWOW64\net.exe
    net stop "Security Center"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1492
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Security Center"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2032
- - C:\Windows\SysWOW64\net.exe
    net stop "Firewall de Windows/Conexi?n compartida a Internet (ICS)"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3800
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "Firewall de Windows/Conexi?n compartida a Internet (ICS)"
      4⤵
      System Location Discovery: System Language Discovery
      PID:2016
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall set opmode mode=disable
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:2340
- - C:\Windows\SysWOW64\net.exe
    net stop "MsMpEng"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:4596
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MsMpEng"
      4⤵
      System Location Discovery: System Language Discovery
      PID:1644
- - C:\Windows\SysWOW64\net.exe
    net stop "MSASCui"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2368
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop "MSASCui"
      4⤵
      System Location Discovery: System Language Discovery
      PID:4568
- - C:\Windows\SysWOW64\taskkill.exe
    Taskkill /f /IM MsMpEng.exe /IM MSASCui.exe
    3⤵
    - System Location Discovery: System Language Discovery
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2488
- - C:\Windows\SysWOW64\attrib.exe
    attrib -H -S -R *.*
    3⤵
    - System Location Discovery: System Language Discovery
    - Views/modifies file attributes
    PID:3128

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\A057.tmp\y.bat

Filesize
12KB

MD5
4b5cc1b45d8fecd590d8490d0f0b6f2a

SHA1
dd5f27e0552fda7a807cb30a615715f5cd44f881

SHA256
da6f172fc4a7a9a4f5d270c7a811633d7a1bd984a9848f490931ba5fe8d0f34b

SHA512
eab6e97771288c35eb0b27741fc96b6554bf650cb004b1a87f3916060e7015176dcdab5adf262fcea9476a48bb0a4a70f18c1eff03031ea0d0a67ac64faf2721

Download Submit
memory/3272-0-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/3272-9-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads