80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd

General

Target
80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe
Size 738KB
Sample241020-cxhw2stdpb
SHA256 80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd
MD5 2b0402915579ce1debc2f6cc55695b78
SHA1 95ef25a88cb77e153984d8cc84f5fcbd9dbf764d
SHA512 90d9770e6d241c6cd91d061e04bb48ad56ecbc271b115bb5a2b030d47397400aae42287954e0fa08da88b266264c419e2aee49231af0cc3966c8381463e00862
SSDEEP 12288:j/En283Cjdq2aXAv2zOLAJMrETpq9dXOyGOs61IYZVAecgs9FMa1Mdq8jJA:jM2gCy42qLAJeETpqDGMIYO7MoOA
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
2300	powershell.exe
1776	powershell.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\Grubstaking.bro	80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1776	powershell.exe
2300	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1776	powershell.exe
Token: SeDebugPrivilege	2300	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2680 wrote to memory of 2300	2680	80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe	30
PID 2680 wrote to memory of 2300	2680	80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe	30
PID 2680 wrote to memory of 2300	2680	80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe	30
PID 2680 wrote to memory of 2300	2680	80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe	30
PID 2680 wrote to memory of 1776	2680	80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe	32
PID 2680 wrote to memory of 1776	2680	80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe	32
PID 2680 wrote to memory of 1776	2680	80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe	32
PID 2680 wrote to memory of 1776	2680	80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe	32

C:\Users\Admin\AppData\Local\Temp\80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe
"C:\Users\Admin\AppData\Local\Temp\80fec3abccd1b92402ee722616dff2605fd5132d9b208d5069c47389247de6dd.exe"
1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2680
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Outbabbled=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\superincomprehensible\Chymes.Ari';$Peract=$Outbabbled.SubString(52410,3);.$Peract($Outbabbled)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2300
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" -windowstyle hidden "$Outbabbled=Get-Content -raw 'C:\Users\Admin\AppData\Local\Temp\superincomprehensible\Chymes.Ari';$Peract=$Outbabbled.SubString(52410,3);.$Peract($Outbabbled)"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1776

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

d93f411851d7c929.customDestinations-ms

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
Size 7KB
SHA256 c602af358e7b58f7a955b9a76952ffe52602dc1f06a9969d37873a8ce93afedb
MD5 787aebd3cb98b902f7ca7b146d6a2986
SHA1 58cfd6d580a7a92f368af75ad58bb40765f90b30
SHA512 b036362348d11a0810d0514532152621845edbe20e19a884bd1e31b12fcc7c34bf28eecf1f6892b11f7258a80936f8715c25dfc1536c9fc08ccc177d07a01bd3
SSDEEP 96:cRb6Cx3M8mnqvsqvJCwol2Rb6Cx3M8mnqvsEHyqvJCwor3V6g6QHQJg7B7XlUVLP:kn36Uolan36AHnor3VMhJg7B7KP
MD5 SHA1 SHA512 SSDEEP

Submit Download

Analysis

Sharing