927410e5f71f8159ec20d0f12f280fbd5187f40b90e8f9f4f9a5b556e5d679d5

Analysis

max time kernel
598s
max time network
602s
platform
windows10-ltsc 2021_x64
resource
win10ltsc2021-20241023-en
resource tags

arch:x64arch:x86image:win10ltsc2021-20241023-enlocale:en-usos:windows10-ltsc 2021-x64system
submitted
30-10-2024 19:15

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

test.exe
Size

27KB
MD5

97dc472b0e7e8fbb5613ba8b4456c49d
SHA1

9d4f28a6fca25c4e478e2582f748288ecf3437a0
SHA256

927410e5f71f8159ec20d0f12f280fbd5187f40b90e8f9f4f9a5b556e5d679d5
SHA512

3b26c906558c26bc795df6114867638249256e1e3a685951a7325bcdc6ff9ed388e7b1f9b1d729247fc6bf82271d54301ac00f9aa5699e38f26e6c8e01dee848
SSDEEP

384:fLbQKJ3bEZjmgERA40DwoyumGPiJRjMFAQk93vmhm7UMKmIEecKdbXTzm9bVhcac:T8K5bEQE40fLFA/vMHTi9bD

Score

7^/10

discovery persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

Processes:

test.exe

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\Control Panel\International\Geo\Nation	test.exe

Drops startup file 4 IoCs

Processes:

Payload.exetest.exe

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	Payload.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Payload.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.exe	Payload.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk	test.exe

Executes dropped EXE 1 IoCs

Processes:

Payload.exe

pid	Process
4892	Payload.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

Processes:

test.exe

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3785588363-1079601362-4184885025-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows2 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Payload.exe"	test.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

test.exePayload.exeattrib.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	test.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Payload.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	attrib.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

Processes:

Payload.exe

description	pid	Process
Token: SeDebugPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe
Token: SeIncBasePriorityPrivilege	4892	Payload.exe
Token: 33	4892	Payload.exe

Suspicious use of WriteProcessMemory 6 IoCs

Processes:

test.exe

description	pid	Process	procid_target
PID 3468 wrote to memory of 4892	3468	test.exe	84
PID 3468 wrote to memory of 4892	3468	test.exe	84
PID 3468 wrote to memory of 4892	3468	test.exe	84
PID 3468 wrote to memory of 724	3468	test.exe	85
PID 3468 wrote to memory of 724	3468	test.exe	85
PID 3468 wrote to memory of 724	3468	test.exe	85

Views/modifies file attributes 1 TTPs 1 IoCs

evasion

Hidden Files and Directories

T1564.001

Processes:

attrib.exe

pid	Process
724	attrib.exe

C:\Users\Admin\AppData\Local\Temp\test.exe
"C:\Users\Admin\AppData\Local\Temp\test.exe"
1⤵
- Checks computer location settings
- Drops startup file
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3468
- C:\Users\Admin\AppData\Local\Temp\Payload.exe
  "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
  2⤵
  - Drops startup file
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  PID:4892
- C:\Windows\SysWOW64\attrib.exe
  attrib +h +r +s "C:\Users\Admin\AppData\Local\Temp\Payload.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Views/modifies file attributes
  PID:724

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Hide Artifacts

T1564

Hidden Files and Directories

T1564.001

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Payload.exe

Filesize
27KB

MD5
97dc472b0e7e8fbb5613ba8b4456c49d

SHA1
9d4f28a6fca25c4e478e2582f748288ecf3437a0

SHA256
927410e5f71f8159ec20d0f12f280fbd5187f40b90e8f9f4f9a5b556e5d679d5

SHA512
3b26c906558c26bc795df6114867638249256e1e3a685951a7325bcdc6ff9ed388e7b1f9b1d729247fc6bf82271d54301ac00f9aa5699e38f26e6c8e01dee848

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Windows.lnk

Filesize
1KB

MD5
8decec1c896e97da17d330be4cf834f2

SHA1
97f0d91cea0f800ee54ddce05a96843775c9e4a6

SHA256
5fdce9b940de68e812add5c736cc77c44137c1178a25d1ea98fd321ae8f78f6d

SHA512
56cb314a949d0fa12a2b2247108741fb8f8dc161d2c55827fa68b2378ad101b249ea574eb57431dc713e3d3f875ecaced7e8cab952a651fb945ddb0d40fcc0e9

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\Windows.lnk

Filesize
1KB

MD5
2c859a1a11342dcb8f21b82de9bb1054

SHA1
5436e61609d9553a6c39248a232211d4854588f3

SHA256
96cff8c2374e75869cdb0a3fc9b541b7dccc5199a2ba02a5559f6009cf5f4ebd

SHA512
742fab9071a266ff14e2fb10b4472cbe936d6f61976869b38ae8aca6121594a0f3a62393e565de413b7817fd142d759b67d259e97ceb90b9e8619853bed6c7cf

Download Submit
memory/3468-19-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/3468-6-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/3468-5-0x0000000075492000-0x0000000075493000-memory.dmp

Filesize
4KB

Download
memory/3468-0-0x0000000075492000-0x0000000075493000-memory.dmp

Filesize
4KB

Download
memory/3468-2-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/3468-1-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/4892-21-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/4892-23-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/4892-20-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download
memory/4892-27-0x0000000075490000-0x0000000075A41000-memory.dmp

Filesize
5.7MB

Download