Analysis
-
max time kernel
95s -
max time network
97s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
09/11/2024, 20:30
Static task
static1
Behavioral task
behavioral1
Sample
66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe
Resource
win10v2004-20241007-en
General
-
Target
66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe
-
Size
68KB
-
MD5
5fc2882dba802600ed868d1cccea5060
-
SHA1
8817ed30aec41884e55fd01414bf85282ae473e0
-
SHA256
66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752e
-
SHA512
5fa4f2002cb935896af7ece07a9c34d9a57e65449cce6ea22b5ba4e07608d5e55d4bc06b0766ae684b569b06049f058031c00a2c788ca1314c1641d102ca2d8d
-
SSDEEP
1536:VDwUvyK+twm87HjWtg9VW1wUDrv3jDHffOSbXOT:RvyJwUtg9AHnOSbY
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\BlockWindows.lnk powershell.exe -
Impair Defenses: Safe Mode Boot 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\SafeBoot\Minimal\DisableSafeMode = "1" powershell.exe -
pid Process 5108 powershell.exe -
System Location Discovery: System Language Discovery 1 TTPs 1 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe -
Kills process with taskkill 1 IoCs
pid Process 3688 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 5108 powershell.exe 5108 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 5108 powershell.exe Token: SeDebugPrivilege 3688 taskkill.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2092 wrote to memory of 2224 2092 66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe 84 PID 2092 wrote to memory of 2224 2092 66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe 84 PID 2224 wrote to memory of 5108 2224 cmd.exe 85 PID 2224 wrote to memory of 5108 2224 cmd.exe 85 PID 5108 wrote to memory of 3688 5108 powershell.exe 87 PID 5108 wrote to memory of 3688 5108 powershell.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe"C:\Users\Admin\AppData\Local\Temp\66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2092 -
C:\Windows\system32\cmd.exe"C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\6F54.tmp\lock.bat "C:\Users\Admin\AppData\Local\Temp\66b802410562811332fee88376be681719a02c8f42e9f508ba573d43264a752eN.exe""2⤵
- Suspicious use of WriteProcessMemory
PID:2224 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exePowerShell -ExecutionPolicy Bypass -File "C:\Users\Admin\AppData\Local\Temp\BlockWindows.ps1"3⤵
- Drops startup file
- Impair Defenses: Safe Mode Boot
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5108 -
C:\Windows\system32\taskkill.exe"C:\Windows\system32\taskkill.exe" /F /IM explorer.exe4⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3688
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88B
MD51bd17ffa60b07280bdb6ff5e257ad872
SHA1113bf27cce1e65477febe8a395c34df1558e39fd
SHA2569f669db892875d281aec91c08edf9e34ecc1dcda3f2d88fe70a119a3da8a2fea
SHA512855484587dfba3313ce1e66e515d53a2423a332ce206d35dfe96e31881a8fda35388ce431bb4f08bfe13fb0aaef534d6b1b0a3050f9f00162e696ae363272381
-
Filesize
5KB
MD5c8f337e720c8097bda0d2c593ae34166
SHA17eaa7e5e32d8eb4e2a87d8c218bc3755cb1fa9bc
SHA2560f266c82f0edafaa2f1d49253de4987c3fa52a908b8123f6dec8646479e56e02
SHA5126bbf7adcfe1573c14f749c70cb23ef7dc0d638f988fe8558cf82f6a89797af45abf0b0dc219750d7e02a609c20196882837735b96c8ba02acbf7fc1175ed06cd
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82