eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
17/10/2024, 15:21

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
Size 1.3MB
Sample241017-srbhsaserb
SHA256 eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f
MD5 50611acb944ba5323ea6cc0a3d7acdd8
SHA1 70a9d56d49cc63807fce3bdcef3a57c2334d8ed7
SHA512 22bc78876699df0e29a11cf0f28d4697798a8033f30cc53795ab6769cfd49aa74e8d33427cbbc35533415224f1abef172761f1fece1fbc299fc220cb0b6e370e
SSDEEP 24576:vU89BNuhZdpM9d/5bmBnqLMKXWTA/nndcUpjYrvgvsteqyCJmAWI0iM8a:MoonKn/5bmBqLMKXNd9Yjgvs9JWI5M8
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2128	powershell.exe
2852	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2880	schtasks.exe

Suspicious behavior: EnumeratesProcesses 13 IoCs

pid	Process
2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
2852	powershell.exe
2128	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
Token: SeDebugPrivilege	2852	powershell.exe
Token: SeDebugPrivilege	2128	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2580 wrote to memory of 2128	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	31
PID 2580 wrote to memory of 2128	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	31
PID 2580 wrote to memory of 2128	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	31
PID 2580 wrote to memory of 2128	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	31
PID 2580 wrote to memory of 2852	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	33
PID 2580 wrote to memory of 2852	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	33
PID 2580 wrote to memory of 2852	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	33
PID 2580 wrote to memory of 2852	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	33
PID 2580 wrote to memory of 2880	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	34
PID 2580 wrote to memory of 2880	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	34
PID 2580 wrote to memory of 2880	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	34
PID 2580 wrote to memory of 2880	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	34
PID 2580 wrote to memory of 2176	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	37
PID 2580 wrote to memory of 2176	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	37
PID 2580 wrote to memory of 2176	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	37
PID 2580 wrote to memory of 2176	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	37
PID 2580 wrote to memory of 2768	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	38
PID 2580 wrote to memory of 2768	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	38
PID 2580 wrote to memory of 2768	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	38
PID 2580 wrote to memory of 2768	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	38
PID 2580 wrote to memory of 2856	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	39
PID 2580 wrote to memory of 2856	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	39
PID 2580 wrote to memory of 2856	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	39
PID 2580 wrote to memory of 2856	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	39
PID 2580 wrote to memory of 2800	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	40
PID 2580 wrote to memory of 2800	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	40
PID 2580 wrote to memory of 2800	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	40
PID 2580 wrote to memory of 2800	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	40
PID 2580 wrote to memory of 2676	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	41
PID 2580 wrote to memory of 2676	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	41
PID 2580 wrote to memory of 2676	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	41
PID 2580 wrote to memory of 2676	2580	eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe	41

C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
"C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2128
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\mDpZqT.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2852
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\mDpZqT" /XML "C:\Users\Admin\AppData\Local\Temp\tmpDB90.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2880
- C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
  "C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe"
  2⤵
  PID:2176
- C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
  "C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe"
  2⤵
  PID:2768
- C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
  "C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe"
  2⤵
  PID:2856
- C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
  "C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe"
  2⤵
  PID:2800
- C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe
  "C:\Users\Admin\AppData\Local\Temp\eb25536bdb4fbc21cefbd43e00f58424c9458eee4059a9d5fa26aaa1c4842e0f.exe"
  2⤵
  PID:2676

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpDB90.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpDB90.tmp
Size 1KB
SHA256 e95bfde8708cfee8d60f03f94fcdd8c53ed134c9c7196e091c75db80c5352471
MD5 8a0c3005bd8ff064d1ef69be1711579b
SHA1 10eeb3077e1a001a0f773a9b572d8722e0c12eaa
SHA512 2890f3401b5217baec3d2b2cb55dc3fa91c33c1b89b9dddb502d1766530507ad7b90ec5cec376d192ceb35efd421315488ac8f1c25ac59f867c6784f6d956a52
MD5 SHA1 SHA512

Submit Download

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 da7967947f44b7f2f129a4fb0d3171742f22e6f7ac5f6d2f4aac1331ba323ee6
MD5 aa6b4c6e2ecb484bbd606faeb9f70d35
SHA1 1b3714e54bfe34ee78543195afa56ed4c1897e6e
SHA512 8290b4e460e660ac1f5216b337473aac3ae07eb2a8bdd119508b196b4231c2c6f38ce3970fce08d3a63c44f903e52b29310f080f7d91c30ec61254f6e03393e5
SSDEEP 96:4ZCCpLM8fnqvsqvJCwotZCCpLM8fnqvsEHyqvJCwork6tuQHjI7duXlUVo:QHLDUoLHLDAHnorktyI7dur
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/2580-0-0x000000007402E000-0x000000007402F000-memory.dmp

Download

memory/2580-1-0x0000000000310000-0x000000000046C000-memory.dmp

Download

memory/2580-2-0x0000000074020000-0x000000007470E000-memory.dmp

Download

memory/2580-3-0x0000000000780000-0x0000000000796000-memory.dmp

Download

memory/2580-4-0x000000007402E000-0x000000007402F000-memory.dmp

Download

memory/2580-5-0x0000000074020000-0x000000007470E000-memory.dmp

Download

memory/2580-6-0x0000000001F00000-0x0000000001F0E000-memory.dmp

Download

memory/2580-7-0x0000000005050000-0x0000000005168000-memory.dmp

Download

memory/2580-20-0x0000000074020000-0x000000007470E000-memory.dmp

Download