224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4ead

Analysis

max time kernel
117s
max time network
95s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
09-10-2024 08:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
Size

349KB
MD5

2320d6ce2e3590f7d5bfcadec4723910
SHA1

cbf9cfebccad089835604c3cf7542126bec33653
SHA256

224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4ead
SHA512

15d17af63ce61d782c2624eef5eaf386414aac76395a19a2eda0bf574dfab87f7d4c24fd16b5c5504047f6e9bb1ba5d853873fcf77b6b12b4ed21aba3e4f428e
SSDEEP

6144:FB1QKZaOpBjQepew/PjuGyFPr527Uf2u/jGw0qun597/QKjJ8zkjDpyAYpI/:FB1Q6rpr7MrswfLjGwW5xFdRyJp6

Score

8^/10

discovery evasion persistence

Malware Config

Signatures

Sets file to hidden 1 TTPs 1 IoCs

Modifies file attributes to stop it showing in Explorer etc.

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
4444	attrib.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe

Adds Run key to start application 2 TTPs 8 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

REG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exeREG.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Google Chrome = "C:\\Users\\Admin\\AppData\\Roaming\\subfolder\\chrome.exe.exe"	REG.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 30 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exeping.exeping.exeattrib.exeping.exeping.exeping.exeREG.exeping.exeping.exeping.exeping.exeping.exeping.exeREG.exeREG.exeping.exeping.exeREG.exeping.exeping.exeping.exeREG.exeREG.exeping.exeping.exeping.exeping.exeREG.exeREG.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	ping.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	REG.exe

System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 20 IoCs

Adversaries may check for Internet connectivity on compromised systems.

discovery

Internet Connection Discovery

T1016.001

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	Process
2168	ping.exe
2888	ping.exe
1428	ping.exe
712	ping.exe
652	ping.exe
3460	ping.exe
2032	ping.exe
1572	ping.exe
2420	ping.exe
3928	ping.exe
3512	ping.exe
4108	ping.exe
2684	ping.exe
3744	ping.exe
4512	ping.exe
3484	ping.exe
3588	ping.exe
4056	ping.exe
988	ping.exe
1820	ping.exe

Runs ping.exe 1 TTPs 20 IoCs

Remote System Discovery

T1018

Processes:

ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exe

pid	Process
3512	ping.exe
2168	ping.exe
4108	ping.exe
1428	ping.exe
712	ping.exe
2684	ping.exe
1572	ping.exe
2032	ping.exe
3484	ping.exe
2420	ping.exe
3744	ping.exe
4512	ping.exe
3588	ping.exe
3460	ping.exe
2888	ping.exe
652	ping.exe
988	ping.exe
4056	ping.exe
1820	ping.exe
3928	ping.exe

Suspicious behavior: EnumeratesProcesses 16 IoCs

Processes:

224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe

pid	Process
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

Processes:

224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe

description	pid	Process
Token: SeDebugPrivilege	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe

Suspicious use of WriteProcessMemory 64 IoCs

Processes:

224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe

description	pid	Process	procid_target
PID 3012 wrote to memory of 2032	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	86
PID 3012 wrote to memory of 2032	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	86
PID 3012 wrote to memory of 2032	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	86
PID 3012 wrote to memory of 3512	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	88
PID 3012 wrote to memory of 3512	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	88
PID 3012 wrote to memory of 3512	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	88
PID 3012 wrote to memory of 2168	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	90
PID 3012 wrote to memory of 2168	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	90
PID 3012 wrote to memory of 2168	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	90
PID 3012 wrote to memory of 4108	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	92
PID 3012 wrote to memory of 4108	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	92
PID 3012 wrote to memory of 4108	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	92
PID 3012 wrote to memory of 2888	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	94
PID 3012 wrote to memory of 2888	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	94
PID 3012 wrote to memory of 2888	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	94
PID 3012 wrote to memory of 1428	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	96
PID 3012 wrote to memory of 1428	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	96
PID 3012 wrote to memory of 1428	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	96
PID 3012 wrote to memory of 712	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	98
PID 3012 wrote to memory of 712	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	98
PID 3012 wrote to memory of 712	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	98
PID 3012 wrote to memory of 2684	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	103
PID 3012 wrote to memory of 2684	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	103
PID 3012 wrote to memory of 2684	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	103
PID 3012 wrote to memory of 4056	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	105
PID 3012 wrote to memory of 4056	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	105
PID 3012 wrote to memory of 4056	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	105
PID 3012 wrote to memory of 652	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	107
PID 3012 wrote to memory of 652	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	107
PID 3012 wrote to memory of 652	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	107
PID 3012 wrote to memory of 4408	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	109
PID 3012 wrote to memory of 4408	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	109
PID 3012 wrote to memory of 4408	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	109
PID 3012 wrote to memory of 4444	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	110
PID 3012 wrote to memory of 4444	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	110
PID 3012 wrote to memory of 4444	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	110
PID 3012 wrote to memory of 3744	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	111
PID 3012 wrote to memory of 3744	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	111
PID 3012 wrote to memory of 3744	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	111
PID 3012 wrote to memory of 4512	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	114
PID 3012 wrote to memory of 4512	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	114
PID 3012 wrote to memory of 4512	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	114
PID 3012 wrote to memory of 1572	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	116
PID 3012 wrote to memory of 1572	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	116
PID 3012 wrote to memory of 1572	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	116
PID 3012 wrote to memory of 2420	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	118
PID 3012 wrote to memory of 2420	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	118
PID 3012 wrote to memory of 2420	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	118
PID 3012 wrote to memory of 3484	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	120
PID 3012 wrote to memory of 3484	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	120
PID 3012 wrote to memory of 3484	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	120
PID 3012 wrote to memory of 3928	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	122
PID 3012 wrote to memory of 3928	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	122
PID 3012 wrote to memory of 3928	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	122
PID 3012 wrote to memory of 3588	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	124
PID 3012 wrote to memory of 3588	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	124
PID 3012 wrote to memory of 3588	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	124
PID 3012 wrote to memory of 988	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	126
PID 3012 wrote to memory of 988	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	126
PID 3012 wrote to memory of 988	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	126
PID 3012 wrote to memory of 3460	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	128
PID 3012 wrote to memory of 3460	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	128
PID 3012 wrote to memory of 3460	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	128
PID 3012 wrote to memory of 1820	3012	224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe	130

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
4444	attrib.exe

C:\Users\Admin\AppData\Local\Temp\224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
"C:\Users\Admin\AppData\Local\Temp\224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3012
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2032
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3512
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2168
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4108
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2888
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1428
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:712
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2684
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4056
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:652
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe
  "\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"
  2⤵
  PID:4408
- C:\Windows\SysWOW64\attrib.exe
  "C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\224fb7cde337d733de3b7bff29b36b2e1c5a0bc0d9718f4e2931572695fa4eadN.exe
  2⤵
  - Sets file to hidden
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:4444
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3744
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:4512
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1572
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:2420
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3484
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3928
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3588
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:988
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:3460
- C:\Windows\SysWOW64\ping.exe
  C:\Windows\System32\ping.exe google.com
  2⤵
  - System Location Discovery: System Language Discovery
  - System Network Configuration Discovery: Internet Connection Discovery
  - Runs ping.exe
  PID:1820
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4640
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3492
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:5108
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:3336
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2744
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:4856
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:2544
- C:\Windows\SysWOW64\REG.exe
  REG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "Google Chrome" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe
  2⤵
  - Adds Run key to start application
  - System Location Discovery: System Language Discovery
  PID:1760

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

Remote System Discovery

T1018

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

System Network Configuration Discovery

T1016

Internet Connection Discovery

T1016.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\subfolder\chrome.exe.exe

Filesize
349KB

MD5
799a6f448fb1779e68163e30d089055d

SHA1
19f7ece2456a0ae3227070194585d8b1db7aefd8

SHA256
709c2b7996fe2bbef9c19e093acad4871e44f2a6dd6a3e5f6ece647ccd08d0d6

SHA512
607ca2dae2c47b486453b7b9f1d2435239e156635df68758d8e398f5fe5f030fa44d7d9aa4a314ed1db828408cbc09afda75bd72f642653ed46f836b1533a399

Download Submit
memory/3012-0-0x0000000075162000-0x0000000075163000-memory.dmp

Filesize
4KB

Download
memory/3012-1-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/3012-2-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download
memory/3012-4-0x0000000075162000-0x0000000075163000-memory.dmp

Filesize
4KB

Download
memory/3012-5-0x0000000075160000-0x0000000075711000-memory.dmp

Filesize
5.7MB

Download