Analysis

  • max time kernel
    120s
  • max time network
    124s
  • platform
    windows7_x64
  • resource
    win7-20240903-en
  • resource tags

    arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
  • submitted
    03/11/2024, 20:44

General

  • Target

    24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe

  • Size

    1.7MB

  • MD5

    15064527753763619d3781b780ded930

  • SHA1

    26d03ea8ced5a9fceb3260cf9e71bf1f08768c8b

  • SHA256

    24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338

  • SHA512

    626a700ab6fc50be15b59e63a5114c100d5b95a6531f24ada010a70f9438f2c769df336980e58bfb4b799e484ec9b897555bc31be3a10fc3b9b356be0452f5de

  • SSDEEP

    49152:qJfJlyMrgsK4Dg2JYYZqNi/3nXeHgUAozs1:qJBlVg2J9SOntVn

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Deletes itself 1 IoCs
  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 20 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe
    "C:\Users\Admin\AppData\Local\Temp\24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe"
    1⤵
    • Drops startup file
    • Loads dropped DLL
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2088
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ACCApi'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:1000
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe" /st 20:50 /du 23:59 /sc daily /ri 1 /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2444
    • C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe
      "C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      PID:1584
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpC12D.tmp.cmd""
      2⤵
      • Deletes itself
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:2232
      • C:\Windows\SysWOW64\timeout.exe
        timeout 6
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:2520

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\tmpC12D.tmp.cmd

          Filesize

          216B

          MD5

          fc60269505c04780d70aa55947f209bb

          SHA1

          e31c5fac2521d556546e0aff041e9735f841800c

          SHA256

          a1469c80b4506bf2bd5ffead834ff586d197a332e7c3581d5cada5d376181963

          SHA512

          21978ada659ff7301868e7577db371ab2b31855a419118daadb0ec5fe02a4b5386269cc839ca2ea3547ca61e18d69834d4028e69d4ecdf1aa9f9df6d959e62bb

        • \Users\Admin\AppData\Roaming\ACCApi\apihost.exe

          Filesize

          1.8MB

          MD5

          585c7471080b240b532ac06e6f2b1abd

          SHA1

          5d61da778845d49fe7b60e7195d68d5af4341fb5

          SHA256

          868573d904c4ec22f1e4402329864881b681a0683a96b5b1094bad9a0bc65342

          SHA512

          e9a18f63810aa3bc8ed642217f3427d34a64034e1c5a788abae39c2f3b3e603b7e8c751e4cf78937212cbb95d88b8a658881c2d8584a36044936357e87d81752

        • memory/1584-10-0x0000000000CD0000-0x0000000000CF4000-memory.dmp

          Filesize

          144KB

        • memory/2088-0-0x0000000073EFE000-0x0000000073EFF000-memory.dmp

          Filesize

          4KB

        • memory/2088-1-0x0000000001300000-0x0000000001324000-memory.dmp

          Filesize

          144KB