Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
21-10-2024 19:42
Behavioral task
behavioral1
Sample
New Client.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
New Client.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
New Client.exe
-
Size
164KB
-
MD5
3020c25093319b8dbea0354a8c819790
-
SHA1
7b1ba6774874cb8f58143da3ef48a4539c89679d
-
SHA256
a80c5e926b48f4263ce1269ea307ec45d1ccae93f9e1e21f3922fbb022c87b59
-
SHA512
1a4df5ed49a4041e3f9f93d527d389233dce44657a31ce06f3a22c98ffde4023c6c73a851aab79afff9d4e5d5f8934d6928350fc9e5cb295702e3c1d504f7893
-
SSDEEP
3072:4aZr/YQa8KwW+/Lvcv89AN2VhR9HNr7DUE1/Y3QbTQ241h66elaH:4auMLEv89ANihRrrHnNYgbTghN
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\Control Panel\International\Geo\Nation New Client.exe -
Drops startup file 4 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini New Client.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini Client.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe Client.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Client.exe Client.exe -
Executes dropped EXE 3 IoCs
pid Process 2904 Client.exe 4972 Client.exe 1576 Client.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe\" .." Client.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Client.exe = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Client.exe\" .." Client.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 28 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Kills process with taskkill 8 IoCs
pid Process 4476 TASKKILL.exe 4856 TASKKILL.exe 1416 TASKKILL.exe 1976 TASKKILL.exe 2340 TASKKILL.exe 5080 TASKKILL.exe 4800 TASKKILL.exe 5080 TASKKILL.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 8 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3688 schtasks.exe 3512 schtasks.exe 2368 schtasks.exe 3432 schtasks.exe 1656 schtasks.exe 3424 schtasks.exe 3492 schtasks.exe 3048 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe 3412 New Client.exe -
Suspicious use of AdjustPrivilegeToken 40 IoCs
description pid Process Token: SeDebugPrivilege 3412 New Client.exe Token: SeDebugPrivilege 4856 TASKKILL.exe Token: SeDebugPrivilege 1416 TASKKILL.exe Token: SeDebugPrivilege 2904 Client.exe Token: SeDebugPrivilege 2340 TASKKILL.exe Token: SeDebugPrivilege 1976 TASKKILL.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: SeDebugPrivilege 5080 TASKKILL.exe Token: SeDebugPrivilege 4800 TASKKILL.exe Token: SeDebugPrivilege 4972 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: SeDebugPrivilege 5080 TASKKILL.exe Token: SeDebugPrivilege 4476 TASKKILL.exe Token: SeDebugPrivilege 1576 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe Token: 33 2904 Client.exe Token: SeIncBasePriorityPrivilege 2904 Client.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 3412 wrote to memory of 1732 3412 New Client.exe 84 PID 3412 wrote to memory of 1732 3412 New Client.exe 84 PID 3412 wrote to memory of 1732 3412 New Client.exe 84 PID 3412 wrote to memory of 3424 3412 New Client.exe 89 PID 3412 wrote to memory of 3424 3412 New Client.exe 89 PID 3412 wrote to memory of 3424 3412 New Client.exe 89 PID 3412 wrote to memory of 1416 3412 New Client.exe 91 PID 3412 wrote to memory of 1416 3412 New Client.exe 91 PID 3412 wrote to memory of 1416 3412 New Client.exe 91 PID 3412 wrote to memory of 4856 3412 New Client.exe 92 PID 3412 wrote to memory of 4856 3412 New Client.exe 92 PID 3412 wrote to memory of 4856 3412 New Client.exe 92 PID 3412 wrote to memory of 4172 3412 New Client.exe 106 PID 3412 wrote to memory of 4172 3412 New Client.exe 106 PID 3412 wrote to memory of 4172 3412 New Client.exe 106 PID 3412 wrote to memory of 3492 3412 New Client.exe 108 PID 3412 wrote to memory of 3492 3412 New Client.exe 108 PID 3412 wrote to memory of 3492 3412 New Client.exe 108 PID 3412 wrote to memory of 2904 3412 New Client.exe 110 PID 3412 wrote to memory of 2904 3412 New Client.exe 110 PID 3412 wrote to memory of 2904 3412 New Client.exe 110 PID 2904 wrote to memory of 3988 2904 Client.exe 111 PID 2904 wrote to memory of 3988 2904 Client.exe 111 PID 2904 wrote to memory of 3988 2904 Client.exe 111 PID 2904 wrote to memory of 3048 2904 Client.exe 113 PID 2904 wrote to memory of 3048 2904 Client.exe 113 PID 2904 wrote to memory of 3048 2904 Client.exe 113 PID 2904 wrote to memory of 2340 2904 Client.exe 115 PID 2904 wrote to memory of 2340 2904 Client.exe 115 PID 2904 wrote to memory of 2340 2904 Client.exe 115 PID 2904 wrote to memory of 1976 2904 Client.exe 116 PID 2904 wrote to memory of 1976 2904 Client.exe 116 PID 2904 wrote to memory of 1976 2904 Client.exe 116 PID 2904 wrote to memory of 3708 2904 Client.exe 122 PID 2904 wrote to memory of 3708 2904 Client.exe 122 PID 2904 wrote to memory of 3708 2904 Client.exe 122 PID 2904 wrote to memory of 3688 2904 Client.exe 124 PID 2904 wrote to memory of 3688 2904 Client.exe 124 PID 2904 wrote to memory of 3688 2904 Client.exe 124 PID 4972 wrote to memory of 3432 4972 Client.exe 129 PID 4972 wrote to memory of 3432 4972 Client.exe 129 PID 4972 wrote to memory of 3432 4972 Client.exe 129 PID 4972 wrote to memory of 3512 4972 Client.exe 131 PID 4972 wrote to memory of 3512 4972 Client.exe 131 PID 4972 wrote to memory of 3512 4972 Client.exe 131 PID 4972 wrote to memory of 5080 4972 Client.exe 133 PID 4972 wrote to memory of 5080 4972 Client.exe 133 PID 4972 wrote to memory of 5080 4972 Client.exe 133 PID 4972 wrote to memory of 4800 4972 Client.exe 135 PID 4972 wrote to memory of 4800 4972 Client.exe 135 PID 4972 wrote to memory of 4800 4972 Client.exe 135 PID 4972 wrote to memory of 4612 4972 Client.exe 137 PID 4972 wrote to memory of 4612 4972 Client.exe 137 PID 4972 wrote to memory of 4612 4972 Client.exe 137 PID 4972 wrote to memory of 2368 4972 Client.exe 139 PID 4972 wrote to memory of 2368 4972 Client.exe 139 PID 4972 wrote to memory of 2368 4972 Client.exe 139 PID 1576 wrote to memory of 1144 1576 Client.exe 152 PID 1576 wrote to memory of 1144 1576 Client.exe 152 PID 1576 wrote to memory of 1144 1576 Client.exe 152 PID 1576 wrote to memory of 3432 1576 Client.exe 154 PID 1576 wrote to memory of 3432 1576 Client.exe 154 PID 1576 wrote to memory of 3432 1576 Client.exe 154 PID 1576 wrote to memory of 5080 1576 Client.exe 156
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Checks computer location settings
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3412 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:1732
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3424
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1416
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4856
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:4172
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3492
-
-
C:\Users\Admin\AppData\Local\Temp\Client.exe"C:\Users\Admin\AppData\Local\Temp\Client.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2904 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F3⤵
- System Location Discovery: System Language Discovery
PID:3988
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 53⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3048
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2340
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1976
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:3708
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3688
-
-
-
C:\Users\Admin\AppData\Local\Temp\Client.exeC:\Users\Admin\AppData\Local\Temp\Client.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4972 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:3432
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3512
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4800
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:4612
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2368
-
-
C:\Users\Admin\AppData\Local\Temp\Client.exeC:\Users\Admin\AppData\Local\Temp\Client.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1576 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:1144
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3432
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:5080
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4476
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:2280
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\Client.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1656
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD540b0c3caa1b14a4c83e8475c46bf2016
SHA1af9575cda4d842f028d18b17063796a894ecd9d0
SHA25670e88a428d92b6ab5905dac9f324824c4c6f120bc3f385c82b2d12f707a4a867
SHA512916437df737de4b6063b7116b4d148229d4a975eb4046122d47434b81fba06e88e09e5f273ec496c81ef3feecb843ccad20a7a04074224416c1fa9951acbdac7
-
Filesize
164KB
MD53020c25093319b8dbea0354a8c819790
SHA17b1ba6774874cb8f58143da3ef48a4539c89679d
SHA256a80c5e926b48f4263ce1269ea307ec45d1ccae93f9e1e21f3922fbb022c87b59
SHA5121a4df5ed49a4041e3f9f93d527d389233dce44657a31ce06f3a22c98ffde4023c6c73a851aab79afff9d4e5d5f8934d6928350fc9e5cb295702e3c1d504f7893