6e2e1eab81dbd88feb2e6f19d7923e2bc0e1ea99c12849d4a2b832bee1e21452

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
02-10-2024 01:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

BL-INV-PL-ISO.exe
Size

813KB
MD5

98764b1ea06180b4a89c043b0fc11914
SHA1

88cdfcf42452ca0429f31fdd8d7372effe387969
SHA256

97fb0388618e3d977b390696f4ca19e38f0e706d70a40726bab9ed8dcdcd036c
SHA512

3d394a5887178f60c6c92f1790314812fe8d13fb0811baeeb7f526eab7bd9f548f9ae8c171361430743efc06ca476145cb53821258fe1cea8d353cdbf87a0211
SSDEEP

12288:M1ZF8Km3Tsu+N7PB6cDS9YGFuzM4DrGUS6ZbxksCsJSxaV5+prfHha9:Mygu2Qc9GwMArGUZZbxksCs9+hfHha

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2336	powershell.exe
2088	powershell.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2428 set thread context of 2668	2428	BL-INV-PL-ISO.exe	40

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	BL-INV-PL-ISO.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 17 IoCs

pid	Process
2428	BL-INV-PL-ISO.exe
2088	powershell.exe
2336	powershell.exe
2428	BL-INV-PL-ISO.exe
2428	BL-INV-PL-ISO.exe
2428	BL-INV-PL-ISO.exe
2428	BL-INV-PL-ISO.exe
2428	BL-INV-PL-ISO.exe
2428	BL-INV-PL-ISO.exe
2428	BL-INV-PL-ISO.exe
2668	vbc.exe
2668	vbc.exe
2668	vbc.exe
2668	vbc.exe
2668	vbc.exe
2668	vbc.exe
2668	vbc.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2428	BL-INV-PL-ISO.exe
Token: SeDebugPrivilege	2088	powershell.exe
Token: SeDebugPrivilege	2336	powershell.exe

Suspicious use of WriteProcessMemory 31 IoCs

description	pid	Process	procid_target
PID 2428 wrote to memory of 2088	2428	BL-INV-PL-ISO.exe	31
PID 2428 wrote to memory of 2088	2428	BL-INV-PL-ISO.exe	31
PID 2428 wrote to memory of 2088	2428	BL-INV-PL-ISO.exe	31
PID 2428 wrote to memory of 2088	2428	BL-INV-PL-ISO.exe	31
PID 2428 wrote to memory of 2336	2428	BL-INV-PL-ISO.exe	33
PID 2428 wrote to memory of 2336	2428	BL-INV-PL-ISO.exe	33
PID 2428 wrote to memory of 2336	2428	BL-INV-PL-ISO.exe	33
PID 2428 wrote to memory of 2336	2428	BL-INV-PL-ISO.exe	33
PID 2428 wrote to memory of 2836	2428	BL-INV-PL-ISO.exe	35
PID 2428 wrote to memory of 2836	2428	BL-INV-PL-ISO.exe	35
PID 2428 wrote to memory of 2836	2428	BL-INV-PL-ISO.exe	35
PID 2428 wrote to memory of 2836	2428	BL-INV-PL-ISO.exe	35
PID 2428 wrote to memory of 2884	2428	BL-INV-PL-ISO.exe	37
PID 2428 wrote to memory of 2884	2428	BL-INV-PL-ISO.exe	37
PID 2428 wrote to memory of 2884	2428	BL-INV-PL-ISO.exe	37
PID 2428 wrote to memory of 2884	2428	BL-INV-PL-ISO.exe	37
PID 2428 wrote to memory of 2860	2428	BL-INV-PL-ISO.exe	38
PID 2428 wrote to memory of 2860	2428	BL-INV-PL-ISO.exe	38
PID 2428 wrote to memory of 2860	2428	BL-INV-PL-ISO.exe	38
PID 2428 wrote to memory of 2860	2428	BL-INV-PL-ISO.exe	38
PID 2428 wrote to memory of 2784	2428	BL-INV-PL-ISO.exe	39
PID 2428 wrote to memory of 2784	2428	BL-INV-PL-ISO.exe	39
PID 2428 wrote to memory of 2784	2428	BL-INV-PL-ISO.exe	39
PID 2428 wrote to memory of 2784	2428	BL-INV-PL-ISO.exe	39
PID 2428 wrote to memory of 2668	2428	BL-INV-PL-ISO.exe	40
PID 2428 wrote to memory of 2668	2428	BL-INV-PL-ISO.exe	40
PID 2428 wrote to memory of 2668	2428	BL-INV-PL-ISO.exe	40
PID 2428 wrote to memory of 2668	2428	BL-INV-PL-ISO.exe	40
PID 2428 wrote to memory of 2668	2428	BL-INV-PL-ISO.exe	40
PID 2428 wrote to memory of 2668	2428	BL-INV-PL-ISO.exe	40
PID 2428 wrote to memory of 2668	2428	BL-INV-PL-ISO.exe	40

C:\Users\Admin\AppData\Local\Temp\BL-INV-PL-ISO.exe
"C:\Users\Admin\AppData\Local\Temp\BL-INV-PL-ISO.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2428
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\BL-INV-PL-ISO.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2088
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\dZxrrOCj.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2336
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\dZxrrOCj" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE495.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2884
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2860
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2784
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2668

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpE495.tmp

Filesize
1KB

MD5
1f0b45b72a77b797bdb4d5da60c5e754

SHA1
24b92de73e54f1954e4e662c4dccccc0f9e63568

SHA256
5332e237075ce11d62664f96482a6b02c44e6d6b6f3967804cbb478fec6aa3b3

SHA512
8d0e6a6a375b41b27fbc6f2e7035b5113a0bbb36a03abc55833a2a773d56a216921068d1726b2952a0b37ab27f42b6d4c4be33ab853ab31b08ae5e4ce9f2313c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
5581e10d747ad653851710defa4b1940

SHA1
944fe1fc8f724100f76ecec8e857899bf4aa9a4c

SHA256
986468a25fdf3849a52bfe07376b784cde0ee498c8665b6dda30488984255438

SHA512
a477becec9c160ab03d804bde879828b75eabd864a1bcc93883ef4e4046ff095b6a2ac57a7501dfd44de8e0c1c423e083fb6705610d6cbe6de4fe33419a72657

Download Submit
memory/2428-6-0x0000000000560000-0x00000000005EE000-memory.dmp

Filesize
568KB

Download
memory/2428-3-0x0000000000340000-0x000000000035E000-memory.dmp

Filesize
120KB

Download
memory/2428-4-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

Filesize
4KB

Download
memory/2428-5-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-0-0x0000000074CEE000-0x0000000074CEF000-memory.dmp

Filesize
4KB

Download
memory/2428-2-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/2428-1-0x0000000000F30000-0x0000000001002000-memory.dmp

Filesize
840KB

Download
memory/2428-25-0x0000000074CE0000-0x00000000753CE000-memory.dmp

Filesize
6.9MB

Download
memory/2668-19-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2668-24-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2668-23-0x00000000FFFDE000-0x00000000FFFDF000-memory.dmp

Filesize
4KB

Download
memory/2668-21-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download