Resubmissions
07-10-2024 05:31
241007-f76bwasdpf 807-10-2024 03:45
241007-ebh12axgna 807-10-2024 03:41
241007-d88ghsxflg 807-10-2024 03:38
241007-d7bfdstbkm 8Analysis
-
max time kernel
840s -
max time network
841s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
07-10-2024 05:31
Static task
static1
Behavioral task
behavioral1
Sample
vTHGfiwMDeoOH5a.exe
Resource
win7-20240708-en
General
-
Target
vTHGfiwMDeoOH5a.exe
-
Size
785KB
-
MD5
3aa5992e9a518e4d1a7042a16b10e31d
-
SHA1
5bce77192abbf2a71a2b19d6b00f08685f569b64
-
SHA256
cfad352d8c9e907269c76b22b73f7a9fa47c3782c99ec48598a310a35d3bdaac
-
SHA512
518b38137a320e3853e28496485c04c933b68ef34f4ef9b4da363711555ea70c11325d4e05d761d5a4aaa199e684e0da084e0226f319cfe3a29dc00d120fed95
-
SSDEEP
24576:A0ixK9bqAGf89ojqUk6fT6xuBgptr6svn6v:9ixKp5NX6BBStr6svnu
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
vTHGfiwMDeoOH5a.exepowershell.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language vTHGfiwMDeoOH5a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 11 IoCs
Processes:
vTHGfiwMDeoOH5a.exepowershell.exepid process 2940 vTHGfiwMDeoOH5a.exe 2940 vTHGfiwMDeoOH5a.exe 2940 vTHGfiwMDeoOH5a.exe 2940 vTHGfiwMDeoOH5a.exe 2940 vTHGfiwMDeoOH5a.exe 2940 vTHGfiwMDeoOH5a.exe 2940 vTHGfiwMDeoOH5a.exe 2940 vTHGfiwMDeoOH5a.exe 2940 vTHGfiwMDeoOH5a.exe 2940 vTHGfiwMDeoOH5a.exe 2740 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
vTHGfiwMDeoOH5a.exepowershell.exedescription pid process Token: SeDebugPrivilege 2940 vTHGfiwMDeoOH5a.exe Token: SeDebugPrivilege 2740 powershell.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
vTHGfiwMDeoOH5a.exedescription pid process target process PID 2940 wrote to memory of 2740 2940 vTHGfiwMDeoOH5a.exe powershell.exe PID 2940 wrote to memory of 2740 2940 vTHGfiwMDeoOH5a.exe powershell.exe PID 2940 wrote to memory of 2740 2940 vTHGfiwMDeoOH5a.exe powershell.exe PID 2940 wrote to memory of 2740 2940 vTHGfiwMDeoOH5a.exe powershell.exe PID 2940 wrote to memory of 2844 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2844 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2844 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2844 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2848 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2848 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2848 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2848 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2604 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2604 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2604 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2604 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2612 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2612 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2612 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2612 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2620 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2620 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2620 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe PID 2940 wrote to memory of 2620 2940 vTHGfiwMDeoOH5a.exe vTHGfiwMDeoOH5a.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2940 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2740 -
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"2⤵PID:2844
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"2⤵PID:2848
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"2⤵PID:2604
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"2⤵PID:2612
-
C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"C:\Users\Admin\AppData\Local\Temp\vTHGfiwMDeoOH5a.exe"2⤵PID:2620