Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/11/2024, 20:44
Static task
static1
Behavioral task
behavioral1
Sample
24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe
Resource
win7-20240903-en
General
-
Target
24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe
-
Size
1.7MB
-
MD5
15064527753763619d3781b780ded930
-
SHA1
26d03ea8ced5a9fceb3260cf9e71bf1f08768c8b
-
SHA256
24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338
-
SHA512
626a700ab6fc50be15b59e63a5114c100d5b95a6531f24ada010a70f9438f2c769df336980e58bfb4b799e484ec9b897555bc31be3a10fc3b9b356be0452f5de
-
SSDEEP
49152:qJfJlyMrgsK4Dg2JYYZqNi/3nXeHgUAozs1:qJBlVg2J9SOntVn
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1000 powershell.exe -
Deletes itself 1 IoCs
pid Process 2232 cmd.exe -
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe -
Executes dropped EXE 1 IoCs
pid Process 1584 apihost.exe -
Loads dropped DLL 1 IoCs
pid Process 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apihost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe -
Delays execution with timeout.exe 1 IoCs
pid Process 2520 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2444 schtasks.exe -
Suspicious behavior: AddClipboardFormatListener 1 IoCs
pid Process 1584 apihost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1000 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe Token: SeDebugPrivilege 1000 powershell.exe Token: SeDebugPrivilege 1584 apihost.exe -
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 2088 wrote to memory of 1000 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 30 PID 2088 wrote to memory of 1000 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 30 PID 2088 wrote to memory of 1000 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 30 PID 2088 wrote to memory of 1000 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 30 PID 2088 wrote to memory of 2444 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 32 PID 2088 wrote to memory of 2444 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 32 PID 2088 wrote to memory of 2444 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 32 PID 2088 wrote to memory of 2444 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 32 PID 2088 wrote to memory of 1584 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 34 PID 2088 wrote to memory of 1584 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 34 PID 2088 wrote to memory of 1584 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 34 PID 2088 wrote to memory of 1584 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 34 PID 2088 wrote to memory of 2232 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 35 PID 2088 wrote to memory of 2232 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 35 PID 2088 wrote to memory of 2232 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 35 PID 2088 wrote to memory of 2232 2088 24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe 35 PID 2232 wrote to memory of 2520 2232 cmd.exe 37 PID 2232 wrote to memory of 2520 2232 cmd.exe 37 PID 2232 wrote to memory of 2520 2232 cmd.exe 37 PID 2232 wrote to memory of 2520 2232 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe"C:\Users\Admin\AppData\Local\Temp\24a23986595cddd1f5ece2a39b39349a0d7101dd98c69b000b54432a3bb9e338.exe"1⤵
- Drops startup file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ACCApi'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1000
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe" /st 20:50 /du 23:59 /sc daily /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2444
-
-
C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe"C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:1584
-
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpC12D.tmp.cmd""2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2232 -
C:\Windows\SysWOW64\timeout.exetimeout 63⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:2520
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
216B
MD5fc60269505c04780d70aa55947f209bb
SHA1e31c5fac2521d556546e0aff041e9735f841800c
SHA256a1469c80b4506bf2bd5ffead834ff586d197a332e7c3581d5cada5d376181963
SHA51221978ada659ff7301868e7577db371ab2b31855a419118daadb0ec5fe02a4b5386269cc839ca2ea3547ca61e18d69834d4028e69d4ecdf1aa9f9df6d959e62bb
-
Filesize
1.8MB
MD5585c7471080b240b532ac06e6f2b1abd
SHA15d61da778845d49fe7b60e7195d68d5af4341fb5
SHA256868573d904c4ec22f1e4402329864881b681a0683a96b5b1094bad9a0bc65342
SHA512e9a18f63810aa3bc8ed642217f3427d34a64034e1c5a788abae39c2f3b3e603b7e8c751e4cf78937212cbb95d88b8a658881c2d8584a36044936357e87d81752