Analysis
-
max time kernel
111s -
max time network
94s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
10-11-2024 01:38
Static task
static1
Behavioral task
behavioral1
Sample
3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe
Resource
win10v2004-20241007-en
General
-
Target
3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe
-
Size
65KB
-
MD5
a70dbc079f9fe5c9729526477515e9e0
-
SHA1
75e00eb31ba762ea155c3f7d78a137313c05c9ae
-
SHA256
3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0c
-
SHA512
2fc1f287d4ec9e4e162f03e03dfd0817b999313b92a7f20fade406b4494ffea3c2be6f30facaf30efce9cbbb1cda9d38c09808f1a9e3dc4463230ba6a4aaf9de
-
SSDEEP
768:MDcpEBMLfQcubV5wGE96YyXDTLdEBBBBZ:MDcfLfIbtEbyXfZc
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe -
Executes dropped EXE 1 IoCs
Processes:
hauhost.exepid process 4152 hauhost.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Windows directory 3 IoCs
Processes:
3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exeattrib.exedescription ioc process File created C:\Windows\Debug\hauhost.exe 3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe File opened for modification C:\Windows\Debug\hauhost.exe 3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe File opened for modification C:\Windows\Debug\hauhost.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exehauhost.exeattrib.execmd.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language hauhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exedescription pid process Token: SeIncBasePriorityPrivilege 3588 3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exedescription pid process target process PID 3588 wrote to memory of 3780 3588 3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe attrib.exe PID 3588 wrote to memory of 3780 3588 3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe attrib.exe PID 3588 wrote to memory of 3780 3588 3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe attrib.exe PID 3588 wrote to memory of 1088 3588 3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe cmd.exe PID 3588 wrote to memory of 1088 3588 3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe cmd.exe PID 3588 wrote to memory of 1088 3588 3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe cmd.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe"C:\Users\Admin\AppData\Local\Temp\3ad4b2704dc7dd432f348157433878a89a05e562640930e3bdfe6960bccdbe0cN.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\attrib.exeattrib +a +s +h +r C:\Windows\Debug\hauhost.exe2⤵
- Sets file to hidden
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:3780 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\3AD4B2~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:1088
-
C:\Windows\Debug\hauhost.exeC:\Windows\Debug\hauhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4152
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
65KB
MD562d7f1549933b37fec8abe7fe99bc88f
SHA16b153e975cacb0a88dc0602054e6dce8c7229263
SHA256fb7c6844e02f3f637b6b3c42fc2e8a98f5f9d567a2d401c4f75ca1ddc4b22db1
SHA51209cea6b328ff12f9f04361791580405e34e2a7f5184e5105c67e0b734812675afdb7ba94e740c031fed2d1be55c7b8f8793207148f9b3854c8f68fe0f546cccf