8a33c8b3367ce89f7b0a54accfb415c98f1c6ebadf1fb72d150c575fa85b7b5d

Resubmissions

11-10-2024 07:33

241011-jd1fbaxerm 10

11-10-2024 07:29

241011-jbkl3sxdpr 10

11-10-2024 07:11

241011-h1ddma1ejb 10

11-10-2024 07:00

241011-hs54nswcrj 10

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
11-10-2024 07:00

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

malw.exe
Size

724KB
MD5

208a7cf0646365f76dd6e381e96cf6f3
SHA1

21d89072373999a525a29882802eb639c6850c03
SHA256

8a33c8b3367ce89f7b0a54accfb415c98f1c6ebadf1fb72d150c575fa85b7b5d
SHA512

05b980d8c72289a5d3e8d4134a9b285c82dea833c5f3016ea627649bfea5def48ddb136e3909b77b37a8b2d017965ac123a023e5439cd1319cda339f94d6a681
SSDEEP

12288:MjqZqdLyerVbCx3YNo18QAulSOfiH93n5N2Ia5oMsn3+wQBBQA6AfwBhptfO5ItE:+qZq5rVbCx3YNdQ1xw5cIhKlBH6EwDzC

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
3068	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	malw.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

pid	Process
2616	malw.exe
2616	malw.exe
2616	malw.exe
2616	malw.exe
2616	malw.exe
2616	malw.exe
2616	malw.exe
2616	malw.exe
2616	malw.exe
2616	malw.exe
2616	malw.exe
3068	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2616	malw.exe
Token: SeDebugPrivilege	3068	powershell.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 2616 wrote to memory of 3068	2616	malw.exe	31
PID 2616 wrote to memory of 3068	2616	malw.exe	31
PID 2616 wrote to memory of 3068	2616	malw.exe	31
PID 2616 wrote to memory of 3068	2616	malw.exe	31
PID 2616 wrote to memory of 2624	2616	malw.exe	32
PID 2616 wrote to memory of 2624	2616	malw.exe	32
PID 2616 wrote to memory of 2624	2616	malw.exe	32
PID 2616 wrote to memory of 2624	2616	malw.exe	32
PID 2616 wrote to memory of 3064	2616	malw.exe	34
PID 2616 wrote to memory of 3064	2616	malw.exe	34
PID 2616 wrote to memory of 3064	2616	malw.exe	34
PID 2616 wrote to memory of 3064	2616	malw.exe	34
PID 2616 wrote to memory of 2676	2616	malw.exe	35
PID 2616 wrote to memory of 2676	2616	malw.exe	35
PID 2616 wrote to memory of 2676	2616	malw.exe	35
PID 2616 wrote to memory of 2676	2616	malw.exe	35
PID 2616 wrote to memory of 2640	2616	malw.exe	36
PID 2616 wrote to memory of 2640	2616	malw.exe	36
PID 2616 wrote to memory of 2640	2616	malw.exe	36
PID 2616 wrote to memory of 2640	2616	malw.exe	36
PID 2616 wrote to memory of 2728	2616	malw.exe	37
PID 2616 wrote to memory of 2728	2616	malw.exe	37
PID 2616 wrote to memory of 2728	2616	malw.exe	37
PID 2616 wrote to memory of 2728	2616	malw.exe	37

C:\Users\Admin\AppData\Local\Temp\malw.exe
"C:\Users\Admin\AppData\Local\Temp\malw.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2616
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\malw.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\malw.exe
  "C:\Users\Admin\AppData\Local\Temp\malw.exe"
  2⤵
  PID:2624
- C:\Users\Admin\AppData\Local\Temp\malw.exe
  "C:\Users\Admin\AppData\Local\Temp\malw.exe"
  2⤵
  PID:3064
- C:\Users\Admin\AppData\Local\Temp\malw.exe
  "C:\Users\Admin\AppData\Local\Temp\malw.exe"
  2⤵
  PID:2676
- C:\Users\Admin\AppData\Local\Temp\malw.exe
  "C:\Users\Admin\AppData\Local\Temp\malw.exe"
  2⤵
  PID:2640
- C:\Users\Admin\AppData\Local\Temp\malw.exe
  "C:\Users\Admin\AppData\Local\Temp\malw.exe"
  2⤵
  PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2616-0-0x00000000745AE000-0x00000000745AF000-memory.dmp

Filesize
4KB

Download
memory/2616-1-0x0000000000350000-0x000000000040C000-memory.dmp

Filesize
752KB

Download
memory/2616-2-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-3-0x0000000000490000-0x00000000004A2000-memory.dmp

Filesize
72KB

Download
memory/2616-4-0x00000000745AE000-0x00000000745AF000-memory.dmp

Filesize
4KB

Download
memory/2616-5-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download
memory/2616-6-0x00000000052F0000-0x000000000536C000-memory.dmp

Filesize
496KB

Download
memory/2616-7-0x00000000745A0000-0x0000000074C8E000-memory.dmp

Filesize
6.9MB

Download