Analysis
-
max time kernel
119s -
max time network
21s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
09/11/2024, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe
Resource
win10v2004-20241007-en
General
-
Target
66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe
-
Size
68KB
-
MD5
5fc2882dba802600ed868d1cccea5060
-
SHA1
8817ed30aec41884e55fd01414bf85282ae473e0
-
SHA256
66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752e
-
SHA512
5fa4f2002cb935896af7ece07a9c34d9a57e65449cce6ea22b5ba4e07608d5e55d4bc06b0766ae684b569b06049f058031c00a2c788ca1314c1641d102ca2d8d
-
SSDEEP
1536:VDwUvyK+twm87HjWtg9VW1wUDrv3jDHffOSbXOT:RvyJwUtg9AHnOSbY
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BlockWindows.lnk powershell.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\DisableSafeMode = "1" powershell.exe -
pid Process 2764 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe -
Kills process with taskkill 1 IoCs
pid Process 2872 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2764 powershell.exe 2764 powershell.exe 2764 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2764 powershell.exe Token: SeDebugPrivilege 2872 taskkill.exe -
Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2364 wrote to memory of 2704 2364 66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe 31 PID 2364 wrote to memory of 2704 2364 66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe 31 PID 2364 wrote to memory of 2704 2364 66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe 31 PID 2364 wrote to memory of 2704 2364 66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe 31 PID 2704 wrote to memory of 2764 2704 cmd.exe 32 PID 2704 wrote to memory of 2764 2704 cmd.exe 32 PID 2704 wrote to memory of 2764 2704 cmd.exe 32 PID 2764 wrote to memory of 2872 2764 powershell.exe 33 PID 2764 wrote to memory of 2872 2764 powershell.exe 33 PID 2764 wrote to memory of 2872 2764 powershell.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe"C:\Users\Admin\AppData\Local\Temp\66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2364 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\1017.tmp\lock.bat "C:\Users\Admin\AppData\Local\Temp\66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2704 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\BlockWindows.ps1"3⤵
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2764 -
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM explorer.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2872
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88B
MD51bd17ffa60b07280bdb6ff5e257ad872
SHA1113bf27cce1e65477febe8a395c34df1558e39fd
SHA2569f669db892875d281aec91c08edf9e34ecc1dcda3f2d88fe70a119a3da8a2fea
SHA512855484587dfba3313ce1e66e515d53a2423a332ce206d35dfe96e31881a8fda35388ce431bb4f08bfe13fb0aaef534d6b1b0a3050f9f00162e696ae363272381
-
Filesize
5KB
MD5c8f337e720c8097bda0d2c593ae34166
SHA17eaa7e5e32d8eb4e2a87d8c218bc3755cb1fa9bc
SHA2560f266c82f0edafaa2f1d49253de4987c3fa52a908b8123f6dec8646479e56e02
SHA5126bbf7adcfe1573c14f749c70cb23ef7dc0d638f988fe8558cf82f6a89797af45abf0b0dc219750d7e02a609c20196882837735b96c8ba02acbf7fc1175ed06cd