9f82994c5a9245dfd9233933c272efc2ae69c6b731bb090b10bdc3fc1d0df46a

Analysis

max time kernel
144s
max time network
149s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22-10-2024 13:57

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

zamowienie_22.exe
Size

770KB
MD5

43a9a9cf3242f8b4b17cdd4ebbe2cd67
SHA1

bfb47cefbc03dfd4bc868971dcce323234d5c92a
SHA256

0f941fbecb454d715d1d229b0a2daaa099a9dd03599485131c49241c2ff62cce
SHA512

417c7db404e5f052057973ac71d7be3d101a439b82ac983a06dda22253db13b504ddbcba07410b09110a73548934766d248260c7d9c16dff559cad27885d4cfc
SSDEEP

24576:bkkDNBR1KThGMMCxMdhnPnsLy1LCMNnk+ot664:VNBbAMuMdhnPnsKGMNnk5Q64

Score

7^/10

discovery

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2528	zamowienie_22.exe
2528	zamowienie_22.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
2528	zamowienie_22.exe
1424	zamowienie_22.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2528 set thread context of 1424	2528	zamowienie_22.exe	31

Drops file in Windows directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\synderegistres.lnk	zamowienie_22.exe
File opened for modification	C:\Windows\negotiate\Anstdeligheden.ini	zamowienie_22.exe
File created	C:\Windows\resources\synderegistres.lnk	zamowienie_22.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zamowienie_22.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	zamowienie_22.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2528	zamowienie_22.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2528 wrote to memory of 1424	2528	zamowienie_22.exe	31
PID 2528 wrote to memory of 1424	2528	zamowienie_22.exe	31
PID 2528 wrote to memory of 1424	2528	zamowienie_22.exe	31
PID 2528 wrote to memory of 1424	2528	zamowienie_22.exe	31
PID 2528 wrote to memory of 1424	2528	zamowienie_22.exe	31
PID 2528 wrote to memory of 1424	2528	zamowienie_22.exe	31

C:\Users\Admin\AppData\Local\Temp\zamowienie_22.exe
"C:\Users\Admin\AppData\Local\Temp\zamowienie_22.exe"
1⤵
- Loads dropped DLL
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2528
- C:\Users\Admin\AppData\Local\Temp\zamowienie_22.exe
  "C:\Users\Admin\AppData\Local\Temp\zamowienie_22.exe"
  2⤵
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - System Location Discovery: System Language Discovery
  PID:1424

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\ProgramData\Microsoft\Windows\Start Menu\eksportafgrde.ini

Filesize
38B

MD5
a0d91a2f9acb4dec3b5260aba27839c4

SHA1
8a9037c691a2bdeebcab8bf3d4c954e62aca9207

SHA256
773cd6fba7d53550b4c41aa889e330b744a7a579df2bb02212773b67e72f5844

SHA512
d3df7852aea197e901c787cd8d943faaa30ee9a6678c4853ed0bb494679897854e4e7556f420f1c176443a485cf1e02e0b4bff86f8da4017a053362b2c9a0608

Download Submit
C:\Windows\Resources\synderegistres.lnk

Filesize
818B

MD5
9fc211b28df85c9518f2e628584cc73d

SHA1
3eeef6d9a5c4b5cc174768eaa459b6ca60795ea2

SHA256
8341c7269e4ee8786506ff22e430a66bc6ac8e454d6d1dfb724a07971e9d8b5a

SHA512
e8073a8c2eafda3f70c045a4b6ff3e05ceffa5ad8664861f07aeca390d998650322e1b3c820deddfc81eb86b1ff66934c611f84d0f6676b332e8d85f673544f6

Download Submit
\Users\Admin\AppData\Local\Temp\nsyCBF8.tmp\System.dll

Filesize
12KB

MD5
12b140583e3273ee1f65016becea58c4

SHA1
92df24d11797fefd2e1f8d29be9dfd67c56c1ada

SHA256
014f1dfeb842cf7265a3644bc6903c592abe9049bfc7396829172d3d72c4d042

SHA512
49ffdfa1941361430b6acb3555fd3aa05e4120f28cbdf7ceaa2af5937d0b8cccd84471cf63f06f97cf203b4aa20f226bdad082e9421b8e6b62ab6e1e9fc1e68a

Download Submit
memory/1424-828-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download
memory/1424-829-0x0000000000400000-0x0000000001462000-memory.dmp

Filesize
16.4MB

Download