Resubmissions
07-10-2024 05:31
241007-f76bwasdpf 807-10-2024 03:45
241007-ebh12axgna 807-10-2024 03:41
241007-d88ghsxflg 807-10-2024 03:38
241007-d7bfdstbkm 8Analysis
-
max time kernel
120s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
07-10-2024 03:38
Static task
static1
Behavioral task
behavioral1
Sample
vTHGfiwMDeoOH5a.exe
Resource
win7-20240903-en
General
-
Target
vTHGfiwMDeoOH5a.exe
-
Size
785KB
-
MD5
3aa5992e9a518e4d1a7042a16b10e31d
-
SHA1
5bce77192abbf2a71a2b19d6b00f08685f569b64
-
SHA256
cfad352d8c9e907269c76b22b73f7a9fa47c3782c99ec48598a310a35d3bdaac
-
SHA512
518b38137a320e3853e28496485c04c933b68ef34f4ef9b4da363711555ea70c11325d4e05d761d5a4aaa199e684e0da084e0226f319cfe3a29dc00d120fed95
-
SSDEEP
24576:A0ixK9bqAGf89ojqUk6fT6xuBgptr6svn6v:9ixKp5NX6BBStr6svnu
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
vTHGfiwMDeoOH5a.exedescription pid process target process PID 2520 set thread context of 2008 2520 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
vTHGfiwMDeoOH5a.exepowershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vTHGfiwMDeoOH5a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
powershell.exevTHGfiwMDeoOH5a.exepid process 3000 powershell.exe 2008 vTHGfiwMDeoOH5a.exe 2008 vTHGfiwMDeoOH5a.exe 2008 vTHGfiwMDeoOH5a.exe 2008 vTHGfiwMDeoOH5a.exe 2008 vTHGfiwMDeoOH5a.exe 2008 vTHGfiwMDeoOH5a.exe 2008 vTHGfiwMDeoOH5a.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 3000 powershell.exe -
Suspicious use of WriteProcessMemory 11 IoCs
Processes:
vTHGfiwMDeoOH5a.exedescription pid process target process PID 2520 wrote to memory of 3000 2520 vTHGfiwMDeoOH5a.exe powershell.exe PID 2520 wrote to memory of 3000 2520 vTHGfiwMDeoOH5a.exe powershell.exe PID 2520 wrote to memory of 3000 2520 vTHGfiwMDeoOH5a.exe powershell.exe PID 2520 wrote to memory of 3000 2520 vTHGfiwMDeoOH5a.exe powershell.exe PID 2520 wrote to memory of 2008 2520 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2520 wrote to memory of 2008 2520 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2520 wrote to memory of 2008 2520 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2520 wrote to memory of 2008 2520 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2520 wrote to memory of 2008 2520 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2520 wrote to memory of 2008 2520 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2520 wrote to memory of 2008 2520 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2520 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3000 -
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:2008