Analysis
-
max time kernel
102s -
max time network
103s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
05-11-2024 00:10
Behavioral task
behavioral1
Sample
28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
120 seconds
Behavioral task
behavioral2
Sample
28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
9 signatures
120 seconds
General
-
Target
28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe
-
Size
65KB
-
MD5
bf27a2b1c3a091d14d52d660baa90f40
-
SHA1
45ff2043a8124b5b7c7f41f2493b501b2be720f8
-
SHA256
28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3
-
SHA512
bfeefe304051b148083a0baa9a67d15e10948292e36ce746c98f1ccf4bd15ca1e7520e09aa75d6b89788473208625e183a47a69a51745db0f139330a1ab2594a
-
SSDEEP
1536:hcEIhoN36t+QviFw1CcWSUVOBnvb9fLteF3nLrB9z3ncaF9bSS9vMp:hcEIhoN36t+QviFCCl8BnJfWl9zsaF9Y
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\MicrosoftBrake 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings OpenWith.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3076 OpenWith.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2496 wrote to memory of 3876 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 92 PID 2496 wrote to memory of 3876 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 92 PID 2496 wrote to memory of 3876 2496 28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe 92 PID 3876 wrote to memory of 1536 3876 cmd.exe 94 PID 3876 wrote to memory of 1536 3876 cmd.exe 94 PID 3876 wrote to memory of 1536 3876 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe"C:\Users\Admin\AppData\Local\Temp\28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2496 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\28f8ffd78f7b6931dc0995a4c4fa08c5d4c97755d7193c56c6e22519253427a3N.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 53⤵
- System Location Discovery: System Language Discovery
PID:1536
-
-
-
C:\Windows\system32\OpenWith.exeC:\Windows\system32\OpenWith.exe -Embedding1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:3076