Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
18/10/2024, 05:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe
Resource
win7-20240708-en
windows7-x64
9 signatures
120 seconds
Behavioral task
behavioral2
Sample
000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
4 signatures
120 seconds
General
-
Target
000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe
-
Size
23KB
-
MD5
630ead1567da1adcf9b4839b65931f40
-
SHA1
9ed7e421a2b08941035f6ff64f23b7e39b657ee1
-
SHA256
000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3a
-
SHA512
83b91fd0977f03a02b1cdb0cddb95bca3048d305c82938c387cff509eeb6fb06ea27bf40cc007ab992da56da7b3040f5186840d1fc668d35a2db95ae808ecc55
-
SSDEEP
384:HPzrvlCK/aPdRI/lc6xJDnojCohobUGO2G0c6uegLYo0qsq5OKh6:HPtp/gRIN/bojCohobUT2w6S70q8
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2632 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe -
Enumerates processes with tasklist 1 TTPs 1 IoCs
pid Process 1856 tasklist.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language tasklist.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1856 tasklist.exe -
Suspicious use of SetWindowsHookAW 64 IoCs
pid Process 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2180 wrote to memory of 2632 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 31 PID 2180 wrote to memory of 2632 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 31 PID 2180 wrote to memory of 2632 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 31 PID 2180 wrote to memory of 2632 2180 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe 31 PID 2632 wrote to memory of 1856 2632 cmd.exe 33 PID 2632 wrote to memory of 1856 2632 cmd.exe 33 PID 2632 wrote to memory of 1856 2632 cmd.exe 33 PID 2632 wrote to memory of 1856 2632 cmd.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe"C:\Users\Admin\AppData\Local\Temp\000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe"1⤵
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookAW
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2180 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c tasklist&&del 000fb48bb8e7e913b03eb052438a3ee6ab3f5a811d25367a0192cda8769f5a3aN.exe2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2632 -
C:\Windows\SysWOW64\tasklist.exetasklist3⤵
- Enumerates processes with tasklist
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
PID:1856
-
-