Analysis
-
max time kernel
126s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-09-2024 23:41
Behavioral task
behavioral1
Sample
NewClient.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
NewClient.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
NewClient.exe
-
Size
164KB
-
MD5
8f91ff6424f45a8e627d4c0f138ea57a
-
SHA1
9af628c435fa387b0b1d486a8239409ae42be227
-
SHA256
2b3612eb432f0d386b66282d33cf4632b9046aa2772bad8ba7289740d9fbeada
-
SHA512
7fd62d99f5dbe21c423ae389cda07a5ae98e17e805d0a66ed22404cf0efb356fdd04b7519f758a470576c6991f4e53881645f38c6fb1a04d7b1b5a1becded308
-
SSDEEP
3072:DibL/dEmP0If8IbsS31NPIuChLdEu9qcxkbGjMMOQvgBJt93:DiYJgQuChKUqBb/MbSJP3
Score
7/10
Malware Config
Signatures
-
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini NewClient.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini NewClient.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini NewClient.exe -
System Location Discovery: System Language Discovery 1 TTPs 24 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NewClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NewClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language NewClient.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Checks processor information in registry 2 TTPs 9 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 6 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Kills process with taskkill 6 IoCs
pid Process 3728 TASKKILL.exe 888 TASKKILL.exe 3448 TASKKILL.exe 4888 TASKKILL.exe 2708 TASKKILL.exe 3296 TASKKILL.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1612 schtasks.exe 5072 schtasks.exe 948 schtasks.exe 1712 schtasks.exe 852 schtasks.exe 1824 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe 1104 NewClient.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 1104 NewClient.exe Token: SeDebugPrivilege 3448 TASKKILL.exe Token: SeDebugPrivilege 4888 TASKKILL.exe Token: SeRestorePrivilege 2428 dw20.exe Token: SeBackupPrivilege 2428 dw20.exe Token: SeBackupPrivilege 2428 dw20.exe Token: SeBackupPrivilege 2428 dw20.exe Token: SeDebugPrivilege 2708 TASKKILL.exe Token: SeDebugPrivilege 3296 TASKKILL.exe Token: SeDebugPrivilege 4368 NewClient.exe Token: SeBackupPrivilege 3324 dw20.exe Token: SeBackupPrivilege 3324 dw20.exe Token: SeDebugPrivilege 2928 NewClient.exe Token: SeDebugPrivilege 3728 TASKKILL.exe Token: SeDebugPrivilege 888 TASKKILL.exe Token: SeBackupPrivilege 1528 dw20.exe Token: SeBackupPrivilege 1528 dw20.exe -
Suspicious use of WriteProcessMemory 63 IoCs
description pid Process procid_target PID 1104 wrote to memory of 1008 1104 NewClient.exe 82 PID 1104 wrote to memory of 1008 1104 NewClient.exe 82 PID 1104 wrote to memory of 1008 1104 NewClient.exe 82 PID 1104 wrote to memory of 1612 1104 NewClient.exe 84 PID 1104 wrote to memory of 1612 1104 NewClient.exe 84 PID 1104 wrote to memory of 1612 1104 NewClient.exe 84 PID 1104 wrote to memory of 3448 1104 NewClient.exe 86 PID 1104 wrote to memory of 3448 1104 NewClient.exe 86 PID 1104 wrote to memory of 3448 1104 NewClient.exe 86 PID 1104 wrote to memory of 4888 1104 NewClient.exe 87 PID 1104 wrote to memory of 4888 1104 NewClient.exe 87 PID 1104 wrote to memory of 4888 1104 NewClient.exe 87 PID 1104 wrote to memory of 3732 1104 NewClient.exe 94 PID 1104 wrote to memory of 3732 1104 NewClient.exe 94 PID 1104 wrote to memory of 3732 1104 NewClient.exe 94 PID 1104 wrote to memory of 5072 1104 NewClient.exe 96 PID 1104 wrote to memory of 5072 1104 NewClient.exe 96 PID 1104 wrote to memory of 5072 1104 NewClient.exe 96 PID 1104 wrote to memory of 2428 1104 NewClient.exe 101 PID 1104 wrote to memory of 2428 1104 NewClient.exe 101 PID 1104 wrote to memory of 2428 1104 NewClient.exe 101 PID 4368 wrote to memory of 2436 4368 NewClient.exe 106 PID 4368 wrote to memory of 2436 4368 NewClient.exe 106 PID 4368 wrote to memory of 2436 4368 NewClient.exe 106 PID 4368 wrote to memory of 948 4368 NewClient.exe 108 PID 4368 wrote to memory of 948 4368 NewClient.exe 108 PID 4368 wrote to memory of 948 4368 NewClient.exe 108 PID 4368 wrote to memory of 2708 4368 NewClient.exe 109 PID 4368 wrote to memory of 2708 4368 NewClient.exe 109 PID 4368 wrote to memory of 2708 4368 NewClient.exe 109 PID 4368 wrote to memory of 3296 4368 NewClient.exe 112 PID 4368 wrote to memory of 3296 4368 NewClient.exe 112 PID 4368 wrote to memory of 3296 4368 NewClient.exe 112 PID 4368 wrote to memory of 3044 4368 NewClient.exe 114 PID 4368 wrote to memory of 3044 4368 NewClient.exe 114 PID 4368 wrote to memory of 3044 4368 NewClient.exe 114 PID 4368 wrote to memory of 1712 4368 NewClient.exe 116 PID 4368 wrote to memory of 1712 4368 NewClient.exe 116 PID 4368 wrote to memory of 1712 4368 NewClient.exe 116 PID 4368 wrote to memory of 3324 4368 NewClient.exe 118 PID 4368 wrote to memory of 3324 4368 NewClient.exe 118 PID 4368 wrote to memory of 3324 4368 NewClient.exe 118 PID 2928 wrote to memory of 2588 2928 NewClient.exe 120 PID 2928 wrote to memory of 2588 2928 NewClient.exe 120 PID 2928 wrote to memory of 2588 2928 NewClient.exe 120 PID 2928 wrote to memory of 852 2928 NewClient.exe 122 PID 2928 wrote to memory of 852 2928 NewClient.exe 122 PID 2928 wrote to memory of 852 2928 NewClient.exe 122 PID 2928 wrote to memory of 3728 2928 NewClient.exe 123 PID 2928 wrote to memory of 3728 2928 NewClient.exe 123 PID 2928 wrote to memory of 3728 2928 NewClient.exe 123 PID 2928 wrote to memory of 888 2928 NewClient.exe 126 PID 2928 wrote to memory of 888 2928 NewClient.exe 126 PID 2928 wrote to memory of 888 2928 NewClient.exe 126 PID 2928 wrote to memory of 2412 2928 NewClient.exe 128 PID 2928 wrote to memory of 2412 2928 NewClient.exe 128 PID 2928 wrote to memory of 2412 2928 NewClient.exe 128 PID 2928 wrote to memory of 1824 2928 NewClient.exe 130 PID 2928 wrote to memory of 1824 2928 NewClient.exe 130 PID 2928 wrote to memory of 1824 2928 NewClient.exe 130 PID 2928 wrote to memory of 1528 2928 NewClient.exe 132 PID 2928 wrote to memory of 1528 2928 NewClient.exe 132 PID 2928 wrote to memory of 1528 2928 NewClient.exe 132
Processes
-
C:\Users\Admin\AppData\Local\Temp\NewClient.exe"C:\Users\Admin\AppData\Local\Temp\NewClient.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:1008
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\NewClient.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1612
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3448
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4888
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:3732
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\NewClient.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:5072
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 12722⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:2428
-
-
C:\Users\Admin\AppData\Local\Temp\NewClient.exeC:\Users\Admin\AppData\Local\Temp\NewClient.exe1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4368 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:2436
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\NewClient.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:948
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3296
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:3044
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\NewClient.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1712
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 12362⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3324
-
-
C:\Users\Admin\AppData\Local\Temp\NewClient.exeC:\Users\Admin\AppData\Local\Temp\NewClient.exe1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2928 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:2588
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\NewClient.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:852
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3728
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:888
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:2412
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\NewClient.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1824
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 11282⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1528
-