60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690

Analysis

max time kernel
120s
max time network
121s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
06-11-2024 14:33

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690.exe
Size

836KB
MD5

2b89f539fc49781f2fc6d8debf491c90
SHA1

227e1d6ff55aac9d09a30050cbe7acabd6df2968
SHA256

60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690
SHA512

bd8a5af726503b17ec860745a4adf39c85c4be92a7c4e545318538bbc52e0f3052d207fe600e5d88cb8a04256867bcb4ae6d541518ed3136afe7c5ce2ae2de02
SSDEEP

24576:OXhejYBQ1sKjVdXgf9lHWstDV8ScB0RpVCg5Ev7ixMmJ:CtKjV6f9lHltDVbcmPoixr

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell and hide display window.

execution

PowerShell

T1059.001

pid	Process
1420	powershell.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Common Files\chagrinets.lnk	60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690.exe
File opened for modification	C:\Program Files (x86)\Common Files\chagrinets.lnk	60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\resources\0409\delarbejders\inhabilitetssprgsmaalene.ini	60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
1420	powershell.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1420	powershell.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1580 wrote to memory of 1420	1580	60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690.exe	30
PID 1580 wrote to memory of 1420	1580	60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690.exe	30
PID 1580 wrote to memory of 1420	1580	60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690.exe	30
PID 1580 wrote to memory of 1420	1580	60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690.exe	30

C:\Users\Admin\AppData\Local\Temp\60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690.exe
"C:\Users\Admin\AppData\Local\Temp\60f7c2d61a09e10204c2c6b359f2d87f3714ebff676a92d38da0af160c738690.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1580
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell.exe -w hidden "$Ungorgeous=Get-Content -raw 'C:\Users\Admin\AppData\Local\vareindkbet\bodements\quickies\Laryngectomize\Listeprisernes.Fak';$Sierran=$Ungorgeous.SubString(54789,3);.$Sierran($Ungorgeous)
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1420

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Common Files\chagrinets.lnk

Filesize
944B

MD5
097d4ba41c39fd321a27639a7899bf43

SHA1
0013c60598926b931685bde52af3a77bb24fa6f9

SHA256
c256ff50375b858b7a8c79e01a865376d0d7a9ec0799abdc81ba0e3feef762ac

SHA512
973c0c0a37721e360e25991f03841b9751eb2d829e5ce1731ff976bd0e75a34d4c4b2b68d3a542ad6f0fdcb5e13951070faaf57fe56655e4c8ed97a82097c671

Download Submit
memory/1420-174-0x0000000073C81000-0x0000000073C82000-memory.dmp

Filesize
4KB

Download
memory/1420-175-0x0000000073C80000-0x000000007422B000-memory.dmp

Filesize
5.7MB

Download
memory/1420-176-0x0000000073C80000-0x000000007422B000-memory.dmp

Filesize
5.7MB

Download
memory/1420-178-0x0000000073C80000-0x000000007422B000-memory.dmp

Filesize
5.7MB

Download
memory/1420-177-0x0000000073C80000-0x000000007422B000-memory.dmp

Filesize
5.7MB

Download
memory/1420-179-0x0000000073C80000-0x000000007422B000-memory.dmp

Filesize
5.7MB

Download