9b66a8ea0f1c64965b06e7a45afbe56f2d4e6d5ef65f32446defccbebe730813

Analysis

max time kernel
94s
max time network
100s
platform
windows10-2004_x64
resource
win10v2004-20240802-en
resource tags

arch:x64arch:x86image:win10v2004-20240802-enlocale:en-usos:windows10-2004-x64system
submitted
01/10/2024, 20:53

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

calc.exe
Size

201KB
MD5

2f9fdad776d8626f2ce8625211831e91
SHA1

21d8413eb0d60b36fc249f8025c277b557fefde3
SHA256

9b66a8ea0f1c64965b06e7a45afbe56f2d4e6d5ef65f32446defccbebe730813
SHA512

2abd61c6bea7c748f81cdd18133582217bd06dd19506f13f89953f8c7bd662fc5233540b9f56c57aa94e038c674128fc46dd280e2f7db642343fc5a45da25feb
SSDEEP

6144:96LkVO8A1X2og0tEHH45Y0KTIVaTycTVDNe4oI:TMJ1X2og0MHGKT3RRwG

Score

9^/10

discovery execution upx

Malware Config

Signatures

Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.

Account Manipulation
T1098

Checks computer location settings 2 TTPs 4 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	calc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	wscript.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	calc.exe
Key value queried	\REGISTRY\USER\S-1-5-21-355097885-2402257403-2971294179-1000\Control Panel\International\Geo\Nation	wscript.exe

UPX packed file 5 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2664-0-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral2/memory/2664-5-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral2/memory/3484-7-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral2/memory/3484-12-0x0000000000400000-0x000000000048B000-memory.dmp	upx
behavioral2/memory/4324-15-0x0000000000400000-0x000000000048B000-memory.dmp	upx

Command and Scripting Interpreter: JavaScript 1 TTPs
execution

JavaScript
T1059.007
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082
Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
discovery

Local Groups
T1069.001

System Location Discovery: System Language Discovery 1 TTPs 13 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	wscript.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	calc.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	net1.exe

Runs net.exe

Suspicious use of WriteProcessMemory 36 IoCs

description	pid	Process	procid_target
PID 2664 wrote to memory of 3364	2664	calc.exe	81
PID 2664 wrote to memory of 3364	2664	calc.exe	81
PID 2664 wrote to memory of 3364	2664	calc.exe	81
PID 3364 wrote to memory of 3564	3364	wscript.exe	82
PID 3364 wrote to memory of 3564	3364	wscript.exe	82
PID 3364 wrote to memory of 3564	3364	wscript.exe	82
PID 3364 wrote to memory of 1996	3364	wscript.exe	83
PID 3364 wrote to memory of 1996	3364	wscript.exe	83
PID 3364 wrote to memory of 1996	3364	wscript.exe	83
PID 3364 wrote to memory of 3484	3364	wscript.exe	86
PID 3364 wrote to memory of 3484	3364	wscript.exe	86
PID 3364 wrote to memory of 3484	3364	wscript.exe	86
PID 1996 wrote to memory of 2636	1996	net.exe	87
PID 1996 wrote to memory of 2636	1996	net.exe	87
PID 1996 wrote to memory of 2636	1996	net.exe	87
PID 3564 wrote to memory of 4988	3564	net.exe	88
PID 3564 wrote to memory of 4988	3564	net.exe	88
PID 3564 wrote to memory of 4988	3564	net.exe	88
PID 3484 wrote to memory of 4284	3484	calc.exe	89
PID 3484 wrote to memory of 4284	3484	calc.exe	89
PID 3484 wrote to memory of 4284	3484	calc.exe	89
PID 4284 wrote to memory of 4404	4284	wscript.exe	90
PID 4284 wrote to memory of 4404	4284	wscript.exe	90
PID 4284 wrote to memory of 4404	4284	wscript.exe	90
PID 4284 wrote to memory of 2820	4284	wscript.exe	92
PID 4284 wrote to memory of 2820	4284	wscript.exe	92
PID 4284 wrote to memory of 2820	4284	wscript.exe	92
PID 4284 wrote to memory of 4324	4284	wscript.exe	94
PID 4284 wrote to memory of 4324	4284	wscript.exe	94
PID 4284 wrote to memory of 4324	4284	wscript.exe	94
PID 4404 wrote to memory of 4872	4404	net.exe	95
PID 4404 wrote to memory of 4872	4404	net.exe	95
PID 4404 wrote to memory of 4872	4404	net.exe	95
PID 2820 wrote to memory of 3776	2820	net.exe	96
PID 2820 wrote to memory of 3776	2820	net.exe	96
PID 2820 wrote to memory of 3776	2820	net.exe	96

C:\Users\Admin\AppData\Local\Temp\calc.exe
"C:\Users\Admin\AppData\Local\Temp\calc.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2664
- C:\Windows\SysWOW64\wscript.exe
  "C:\Windows\System32\wscript.exe" PVxxdJ4vxx.jse
  2⤵
  - Checks computer location settings
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3364
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" user LocalAdministrator /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3564
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 user LocalAdministrator /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:4988
- - C:\Windows\SysWOW64\net.exe
    "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:1996
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
      4⤵
      System Location Discovery: System Language Discovery
      PID:2636
- - C:\Users\Admin\AppData\Local\Temp\calc.exe
    "C:\Users\Admin\AppData\Local\Temp\calc.exe"
    3⤵
    - Checks computer location settings
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3484
  - - C:\Windows\SysWOW64\wscript.exe
      "C:\Windows\System32\wscript.exe" 7iVrIToTn0.jse
      4⤵
      Checks computer location settings
      System Location Discovery: System Language Discovery
      Suspicious use of WriteProcessMemory
      PID:4284
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" user LocalAdministrator /add
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:4404
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 user LocalAdministrator /add
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:4872
    - - C:\Windows\SysWOW64\net.exe
        
        "C:\Windows\System32\net.exe" localgroup administrators LocalAdministrator /add
        5⤵
        System Location Discovery: System Language Discovery
        Suspicious use of WriteProcessMemory
        
        PID:2820
      - C:\Windows\SysWOW64\net1.exe
        
        C:\Windows\system32\net1 localgroup administrators LocalAdministrator /add
        6⤵
        System Location Discovery: System Language Discovery
        
        PID:3776
    - - C:\Users\Admin\AppData\Local\Temp\calc.exe
        
        "C:\Users\Admin\AppData\Local\Temp\calc.exe"
        5⤵
        System Location Discovery: System Language Discovery
        
        PID:4324

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

JavaScript

T1059.007

Persistence

Account Manipulation

T1098

Privilege Escalation

Account Manipulation

T1098

Defense Evasion

Credential Access

Discovery

Permission Groups Discovery

T1069

Local Groups

T1069.001

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\PVxxdJ4vxx.jse

Filesize
905B

MD5
b4eb7f28555dda63f591a950f2db89d1

SHA1
92ba2174422096a09ce506c041165564360accc3

SHA256
00c9f54dc4deec12db8ba086ec347d03f978e46222d9c5ec5c6240f7ac171c5c

SHA512
3268de3032832a54e3251589b6d41ff43f3181e7fbc5de6d466ea45c6db0c8bba6704f87954b4e28a9273067ebe20066169ff70f896a236a3f786291fb660d24

Download Submit
memory/2664-0-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/2664-5-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3484-7-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/3484-12-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download
memory/4324-15-0x0000000000400000-0x000000000048B000-memory.dmp

Filesize
556KB

Download