Analysis
-
max time kernel
150s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20240802-en -
resource tags
arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system -
submitted
29-09-2024 19:12
Behavioral task
behavioral1
Sample
New Client.exe
Resource
win7-20240903-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
New Client.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
New Client.exe
-
Size
164KB
-
MD5
8f91ff6424f45a8e627d4c0f138ea57a
-
SHA1
9af628c435fa387b0b1d486a8239409ae42be227
-
SHA256
2b3612eb432f0d386b66282d33cf4632b9046aa2772bad8ba7289740d9fbeada
-
SHA512
7fd62d99f5dbe21c423ae389cda07a5ae98e17e805d0a66ed22404cf0efb356fdd04b7519f758a470576c6991f4e53881645f38c6fb1a04d7b1b5a1becded308
-
SSDEEP
3072:DibL/dEmP0If8IbsS31NPIuChLdEu9qcxkbGjMMOQvgBJt93:DiYJgQuChKUqBb/MbSJP3
Score
7/10
Malware Config
Signatures
-
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini New Client.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini New Client.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini New Client.exe -
System Location Discovery: System Language Discovery 1 TTPs 23 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe -
Checks processor information in registry 2 TTPs 6 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe -
Enumerates system info in registry 2 TTPs 4 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Kills process with taskkill 6 IoCs
pid Process 700 TASKKILL.exe 3024 TASKKILL.exe 664 TASKKILL.exe 4072 TASKKILL.exe 4696 TASKKILL.exe 5020 TASKKILL.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 6 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2380 schtasks.exe 3564 schtasks.exe 1488 schtasks.exe 2764 schtasks.exe 4992 schtasks.exe 4260 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe 3664 New Client.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 3664 New Client.exe Token: SeDebugPrivilege 5020 TASKKILL.exe Token: SeDebugPrivilege 4696 TASKKILL.exe Token: SeBackupPrivilege 4220 dw20.exe Token: SeBackupPrivilege 4220 dw20.exe Token: SeDebugPrivilege 700 TASKKILL.exe Token: SeDebugPrivilege 3024 TASKKILL.exe Token: SeDebugPrivilege 4792 New Client.exe Token: SeBackupPrivilege 1048 dw20.exe Token: SeBackupPrivilege 1048 dw20.exe Token: SeDebugPrivilege 3916 New Client.exe Token: SeDebugPrivilege 4072 TASKKILL.exe Token: SeDebugPrivilege 664 TASKKILL.exe -
Suspicious use of WriteProcessMemory 60 IoCs
description pid Process procid_target PID 3664 wrote to memory of 2468 3664 New Client.exe 89 PID 3664 wrote to memory of 2468 3664 New Client.exe 89 PID 3664 wrote to memory of 2468 3664 New Client.exe 89 PID 3664 wrote to memory of 1488 3664 New Client.exe 91 PID 3664 wrote to memory of 1488 3664 New Client.exe 91 PID 3664 wrote to memory of 1488 3664 New Client.exe 91 PID 3664 wrote to memory of 4696 3664 New Client.exe 93 PID 3664 wrote to memory of 4696 3664 New Client.exe 93 PID 3664 wrote to memory of 4696 3664 New Client.exe 93 PID 3664 wrote to memory of 5020 3664 New Client.exe 94 PID 3664 wrote to memory of 5020 3664 New Client.exe 94 PID 3664 wrote to memory of 5020 3664 New Client.exe 94 PID 3664 wrote to memory of 1320 3664 New Client.exe 105 PID 3664 wrote to memory of 1320 3664 New Client.exe 105 PID 3664 wrote to memory of 1320 3664 New Client.exe 105 PID 3664 wrote to memory of 2764 3664 New Client.exe 107 PID 3664 wrote to memory of 2764 3664 New Client.exe 107 PID 3664 wrote to memory of 2764 3664 New Client.exe 107 PID 3664 wrote to memory of 4220 3664 New Client.exe 109 PID 3664 wrote to memory of 4220 3664 New Client.exe 109 PID 3664 wrote to memory of 4220 3664 New Client.exe 109 PID 4792 wrote to memory of 2128 4792 New Client.exe 114 PID 4792 wrote to memory of 2128 4792 New Client.exe 114 PID 4792 wrote to memory of 2128 4792 New Client.exe 114 PID 4792 wrote to memory of 4992 4792 New Client.exe 116 PID 4792 wrote to memory of 4992 4792 New Client.exe 116 PID 4792 wrote to memory of 4992 4792 New Client.exe 116 PID 4792 wrote to memory of 700 4792 New Client.exe 117 PID 4792 wrote to memory of 700 4792 New Client.exe 117 PID 4792 wrote to memory of 700 4792 New Client.exe 117 PID 4792 wrote to memory of 3024 4792 New Client.exe 118 PID 4792 wrote to memory of 3024 4792 New Client.exe 118 PID 4792 wrote to memory of 3024 4792 New Client.exe 118 PID 4792 wrote to memory of 1228 4792 New Client.exe 122 PID 4792 wrote to memory of 1228 4792 New Client.exe 122 PID 4792 wrote to memory of 1228 4792 New Client.exe 122 PID 4792 wrote to memory of 4260 4792 New Client.exe 124 PID 4792 wrote to memory of 4260 4792 New Client.exe 124 PID 4792 wrote to memory of 4260 4792 New Client.exe 124 PID 4792 wrote to memory of 1048 4792 New Client.exe 126 PID 4792 wrote to memory of 1048 4792 New Client.exe 126 PID 4792 wrote to memory of 1048 4792 New Client.exe 126 PID 3916 wrote to memory of 3988 3916 New Client.exe 128 PID 3916 wrote to memory of 3988 3916 New Client.exe 128 PID 3916 wrote to memory of 3988 3916 New Client.exe 128 PID 3916 wrote to memory of 2380 3916 New Client.exe 130 PID 3916 wrote to memory of 2380 3916 New Client.exe 130 PID 3916 wrote to memory of 2380 3916 New Client.exe 130 PID 3916 wrote to memory of 664 3916 New Client.exe 131 PID 3916 wrote to memory of 664 3916 New Client.exe 131 PID 3916 wrote to memory of 664 3916 New Client.exe 131 PID 3916 wrote to memory of 4072 3916 New Client.exe 132 PID 3916 wrote to memory of 4072 3916 New Client.exe 132 PID 3916 wrote to memory of 4072 3916 New Client.exe 132 PID 3916 wrote to memory of 1648 3916 New Client.exe 136 PID 3916 wrote to memory of 1648 3916 New Client.exe 136 PID 3916 wrote to memory of 1648 3916 New Client.exe 136 PID 3916 wrote to memory of 3564 3916 New Client.exe 138 PID 3916 wrote to memory of 3564 3916 New Client.exe 138 PID 3916 wrote to memory of 3564 3916 New Client.exe 138
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3664 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:2468
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1488
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4696
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5020
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:1320
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2764
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 18522⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:4220
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --field-trial-handle=4512,i,16315016104747277319,5510969007830467313,262144 --variations-seed-version --mojo-platform-channel-handle=3676 /prefetch:81⤵PID:4244
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4792 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:2128
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4992
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:700
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3024
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:1228
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:4260
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 11722⤵
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1048
-
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3916 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:3988
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2380
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:664
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4072
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:1648
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3564
-