Analysis
- max time kernel
104s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
24/10/2024, 09:18
General
- Target mm.exe
- Size 760KB
- Sample241024-k9pt5a1dma
- SHA256 6a92c0e725d1b223168728cd7be319783abbfcc1f61c941bfdff7eb6a51ddeb6
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Suspicious use of SetThreadContext 1 IoCs
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 19 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 9 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\mm.exe"C:\Users\Admin\AppData\Local\Temp\mm.exe"1⤵
- Checks computer location settings
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\mm.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\mm.exe"C:\Users\Admin\AppData\Local\Temp\mm.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_10isiu1z.2js.ps1
memory/672-11-0x0000000000400000-0x0000000000446000-memory.dmp
memory/672-64-0x0000000000400000-0x0000000000446000-memory.dmp
memory/672-63-0x00000000017C0000-0x0000000001B0A000-memory.dmp
memory/672-62-0x0000000000400000-0x0000000000446000-memory.dmp
memory/1648-31-0x0000000005520000-0x0000000005874000-memory.dmp
memory/1648-33-0x0000000005B30000-0x0000000005B7C000-memory.dmp
memory/1648-61-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/1648-57-0x0000000007160000-0x000000000717A000-memory.dmp
memory/1648-58-0x0000000007140000-0x0000000007148000-memory.dmp
memory/1648-56-0x0000000007060000-0x0000000007074000-memory.dmp
memory/1648-55-0x0000000007050000-0x000000000705E000-memory.dmp
memory/1648-54-0x0000000007020000-0x0000000007031000-memory.dmp
memory/1648-15-0x00000000021D0000-0x0000000002206000-memory.dmp
memory/1648-14-0x000000007492E000-0x000000007492F000-memory.dmp
memory/1648-16-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/1648-17-0x0000000004D90000-0x00000000053B8000-memory.dmp
memory/1648-18-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/1648-21-0x00000000054B0000-0x0000000005516000-memory.dmp
memory/1648-20-0x0000000004CE0000-0x0000000004D46000-memory.dmp
memory/1648-19-0x0000000004A40000-0x0000000004A62000-memory.dmp
memory/1648-53-0x00000000070A0000-0x0000000007136000-memory.dmp
memory/1648-52-0x0000000006E90000-0x0000000006E9A000-memory.dmp
memory/1648-32-0x0000000005B00000-0x0000000005B1E000-memory.dmp
memory/1648-51-0x0000000006E20000-0x0000000006E3A000-memory.dmp
memory/1648-35-0x0000000070740000-0x000000007078C000-memory.dmp
memory/1648-38-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/1648-34-0x0000000006AB0000-0x0000000006AE2000-memory.dmp
memory/1648-48-0x0000000006CF0000-0x0000000006D93000-memory.dmp
memory/1648-47-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/1648-49-0x0000000074920000-0x00000000750D0000-memory.dmp
memory/1648-46-0x00000000060D0000-0x00000000060EE000-memory.dmp
memory/1648-50-0x0000000007470000-0x0000000007AEA000-memory.dmp
memory/2512-4-0x00000000748A0000-0x0000000075050000-memory.dmp
memory/2512-0-0x00000000748AE000-0x00000000748AF000-memory.dmp
memory/2512-5-0x0000000005030000-0x000000000503A000-memory.dmp
memory/2512-13-0x00000000748A0000-0x0000000075050000-memory.dmp
memory/2512-6-0x0000000005110000-0x00000000051AC000-memory.dmp
memory/2512-10-0x0000000004890000-0x000000000491E000-memory.dmp
memory/2512-9-0x00000000748A0000-0x0000000075050000-memory.dmp
memory/2512-8-0x00000000748AE000-0x00000000748AF000-memory.dmp
memory/2512-7-0x0000000007C10000-0x0000000007C2E000-memory.dmp
memory/2512-3-0x0000000004E80000-0x0000000004F12000-memory.dmp
memory/2512-2-0x0000000005430000-0x00000000059D4000-memory.dmp
memory/2512-1-0x00000000003D0000-0x0000000000490000-memory.dmp