Analysis
-
max time kernel
122s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
01-10-2024 05:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
お見積り依頼.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
150 seconds
General
-
Target
お見積り依頼.exe
-
Size
630KB
-
MD5
728097746e8c33931674db66a3e707a1
-
SHA1
b3370f0d1f3627ef07e1f0a5ca0ecb29ba1d51b4
-
SHA256
40ea892bdc93f4572d6bf98bcfe64444b304d3295ac956b24756152fed8ed97e
-
SHA512
dd33fa59a0bfa914c55edcc15db3e5220f75cdae4dcf0ae549792970e558b80e486a9942c93d9f7673edc17a33ddb184ea65445b8ae001d2155620da36a4dcf8
-
SSDEEP
12288:/R1/lvG0+2fXd+aP7zsCbgZpsLIStlsZifh:/zQ9VaPExeISwa
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2676 powershell.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\taskschd.msc mmc.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 2596 2708 WerFault.exe 30 -
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language お見積り依頼.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
pid Process 2708 お見積り依頼.exe 2708 お見積り依頼.exe 2708 お見積り依頼.exe 2676 powershell.exe 2708 お見積り依頼.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2628 mmc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2708 お見積り依頼.exe Token: SeDebugPrivilege 2676 powershell.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe Token: 33 2628 mmc.exe Token: SeIncBasePriorityPrivilege 2628 mmc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2628 mmc.exe 2628 mmc.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2708 wrote to memory of 2676 2708 お見積り依頼.exe 31 PID 2708 wrote to memory of 2676 2708 お見積り依頼.exe 31 PID 2708 wrote to memory of 2676 2708 お見積り依頼.exe 31 PID 2708 wrote to memory of 2676 2708 お見積り依頼.exe 31 PID 2708 wrote to memory of 2596 2708 お見積り依頼.exe 33 PID 2708 wrote to memory of 2596 2708 お見積り依頼.exe 33 PID 2708 wrote to memory of 2596 2708 お見積り依頼.exe 33 PID 2708 wrote to memory of 2596 2708 お見積り依頼.exe 33 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\お見積り依頼.exe"C:\Users\Admin\AppData\Local\Temp\お見積り依頼.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\お見積り依頼.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2676
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2708 -s 8522⤵
- Program crash
PID:2596
-
-
C:\Windows\system32\mmc.exe"C:\Windows\system32\mmc.exe" "C:\Windows\system32\taskschd.msc" /s1⤵
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2628