Analysis
-
max time kernel
111s -
max time network
107s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
31/10/2024, 04:21
Behavioral task
behavioral1
Sample
a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe
Resource
win10v2004-20241007-en
General
-
Target
a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe
-
Size
37KB
-
MD5
8a2c4dfca2c807e0038832937b506380
-
SHA1
6d55e67061809c42b9d0a6f86687aa40fe048777
-
SHA256
a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761
-
SHA512
62cb76464c71b1a97e196fda016885722cefd61a206e6455318f20155c9b78b27a605a307d03feaf30677a58f789217e299274d5bf0d3e02ddbed0d94e9c810f
-
SSDEEP
768:AnoSEjp9Plchfr6TUqnbcuyD7UYK41lll/J0ppppCwwwcooodwwwt111q1YYYU/T:AoSEZWTUUqnouy8YX/vooodwwwt111+p
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3756129449-3121373848-4276368241-1000\Control Panel\International\Geo\Nation a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe -
Executes dropped EXE 1 IoCs
pid Process 4644 pwshost.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
resource yara_rule behavioral2/memory/3028-0-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/files/0x000c000000023b54-3.dat upx behavioral2/memory/3028-6-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4644-7-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4644-13-0x0000000000400000-0x000000000040E000-memory.dmp upx behavioral2/memory/4644-16-0x0000000000400000-0x000000000040E000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Debug\pwshost.exe a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe File opened for modification C:\Windows\Debug\pwshost.exe a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pwshost.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 pwshost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz pwshost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 3028 a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3028 wrote to memory of 2384 3028 a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe 90 PID 3028 wrote to memory of 2384 3028 a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe 90 PID 3028 wrote to memory of 2384 3028 a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe 90
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe"C:\Users\Admin\AppData\Local\Temp\a2d97b2b6adb9eddb7dd59b334e5ff9917c8de7fe5d6c9eb153a9e44e773d761N.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3028 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\A2D97B~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:2384
-
-
C:\Windows\Debug\pwshost.exeC:\Windows\Debug\pwshost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:4644
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD55179511c7b6d080f6474f5c802151e24
SHA10cf7ec85cc7a896468c845b92154edb08d8ff9eb
SHA2561809414d5405ee2d24fdaa288acca74e1ce7d74298dad84fa4072d021aedc668
SHA51285e10dee9c355392446f981b8c8fef474f0585a8d12f5519435ef8ef7dd9a7e3b8442d01ea565b57a4318639af4b46e1aaf0686ad26a3a0ae23dee3fd42f9cc3