e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4

Analysis

max time kernel
7s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 03:47

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe
Size 405KB
Sample241110-ecd4gaskap
SHA256 e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4
MD5 c49ffff2befecbcb7464d0835c765d8b
SHA1 6af5e87d57cba9f526e18e503595266599d1fb11
SHA512 8874ad9d3465d40a585c561ce1c0b620eaa4baabc8ee1d522e7202e285c5d062c145786564270175e3d5527274e03d669282ce2ee12dcd917916c17d6146625c
SSDEEP 6144:foYn9sE89XKTK/J6brj3nmHWrt63P5A9GJ6vbmF4ifKyjlKI4r3mzzrLVIo8ZJr6:ZsNDBIrCHWux6iFTJf4r2zPBv8Xi8xS
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery persistence upx

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe

Executes dropped EXE 1 IoCs

pid	Process
3156	javaruntime.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\javaruntime = "C:\\Windows\\javaruntime.exe"	reg.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3116 set thread context of 4720	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	91
PID 3116 set thread context of 1636	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	92

UPX packed file 26 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/3116-0-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/3116-13-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1636-14-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1636-18-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/3116-22-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1636-16-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/files/0x0003000000022a9f-36.dat	upx
behavioral2/memory/3156-44-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/3156-48-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/3156-56-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1636-55-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1068-64-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1068-67-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1068-66-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/3156-74-0x0000000000400000-0x000000000052D000-memory.dmp	upx
behavioral2/memory/1636-76-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/4828-78-0x0000000000400000-0x000000000040B000-memory.dmp	upx
behavioral2/memory/1068-81-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1068-83-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1068-86-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1068-88-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1068-90-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1068-93-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1068-95-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1068-97-0x0000000000400000-0x000000000047B000-memory.dmp	upx
behavioral2/memory/1068-102-0x0000000000400000-0x000000000047B000-memory.dmp	upx

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\javaruntime.exe	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe
File opened for modification	C:\Windows\javaruntime.exe	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	svchost.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	javaruntime.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
1916	reg.exe
4888	reg.exe
3020	reg.exe
5016	reg.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe
4720	svchost.exe

Suspicious use of SetWindowsHookEx 5 IoCs

pid	Process
3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe
4720	svchost.exe
1636	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe
3156	javaruntime.exe
3156	javaruntime.exe

Suspicious use of WriteProcessMemory 26 IoCs

description	pid	Process	procid_target
PID 3116 wrote to memory of 4720	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	91
PID 3116 wrote to memory of 4720	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	91
PID 3116 wrote to memory of 4720	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	91
PID 3116 wrote to memory of 4720	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	91
PID 3116 wrote to memory of 4720	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	91
PID 3116 wrote to memory of 4720	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	91
PID 3116 wrote to memory of 4720	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	91
PID 3116 wrote to memory of 4720	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	91
PID 3116 wrote to memory of 4720	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	91
PID 3116 wrote to memory of 1636	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	92
PID 3116 wrote to memory of 1636	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	92
PID 3116 wrote to memory of 1636	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	92
PID 3116 wrote to memory of 1636	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	92
PID 3116 wrote to memory of 1636	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	92
PID 3116 wrote to memory of 1636	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	92
PID 3116 wrote to memory of 1636	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	92
PID 3116 wrote to memory of 1636	3116	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	92
PID 1636 wrote to memory of 2896	1636	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	93
PID 1636 wrote to memory of 2896	1636	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	93
PID 1636 wrote to memory of 2896	1636	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	93
PID 2896 wrote to memory of 4680	2896	cmd.exe	96
PID 2896 wrote to memory of 4680	2896	cmd.exe	96
PID 2896 wrote to memory of 4680	2896	cmd.exe	96
PID 1636 wrote to memory of 3156	1636	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	98
PID 1636 wrote to memory of 3156	1636	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	98
PID 1636 wrote to memory of 3156	1636	e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe	98

C:\Users\Admin\AppData\Local\Temp\e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe
"C:\Users\Admin\AppData\Local\Temp\e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3116
- C:\Windows\SysWOW64\svchost.exe
  "C:\Windows\system32\svchost.exe"
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  PID:4720
- C:\Users\Admin\AppData\Local\Temp\e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe
  "C:\Users\Admin\AppData\Local\Temp\e679ff257da9e54f92ba2b3f08bc2ba463581780626c17032563c242d85203e4.exe"
  2⤵
  - Checks computer location settings
  - Drops file in Windows directory
  - System Location Discovery: System Language Discovery
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:1636
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\AQQOW.bat" "
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:2896
  - - C:\Windows\SysWOW64\reg.exe
      REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "javaruntime" /t REG_SZ /d "C:\Windows\javaruntime.exe" /f
      4⤵
      Adds Run key to start application
      System Location Discovery: System Language Discovery
      PID:4680
- - C:\Windows\javaruntime.exe
    "C:\Windows\javaruntime.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:3156
  - - C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      4⤵
      PID:2016
  - - C:\Windows\javaruntime.exe
      "C:\Windows\javaruntime.exe"
      4⤵
      PID:4828
  - - C:\Windows\javaruntime.exe
      "C:\Windows\javaruntime.exe"
      4⤵
      PID:1068
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:2808
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies registry key
        
        PID:3020
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
        5⤵
        
        PID:3904
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\javaruntime.exe" /t REG_SZ /d "C:\Windows\javaruntime.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies registry key
        
        PID:5016
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        5⤵
        
        PID:2940
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f
        6⤵
        Modifies registry key
        
        PID:4888
    - - C:\Windows\SysWOW64\cmd.exe
        
        cmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
        5⤵
        
        PID:1804
      - C:\Windows\SysWOW64\reg.exe
        
        REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\winprocess.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\winprocess.exe:*:Enabled:Windows Messanger" /f
        6⤵
        Modifies registry key
        
        PID:1916

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

AQQOW.txt

Path C:\Users\Admin\AppData\Local\Temp\AQQOW.txt
Size 124B
SHA256 dc60287c419225759aa9e1ea0423be4106337dad71aaa0cdc9d55d2b1af3edb7
MD5 163f8e838efe1d166ffff7408b814e28
SHA1 52fa0ccba649587e7d24d21d182657078fa6d028
SHA512 b6685390029555f7d812f0d1a9f138c619555712add3e79c1c90a1a5a0c544e4a86768a626d25c6af3cec09afc0bbaf7f398114e849831bdc5666fc443a1f68d
MD5 SHA1 SHA512

Submit Download

javaruntime.exe

Path C:\Windows\javaruntime.exe
Size 405KB
SHA256 9b1c4d126fc956563b01eb6fb540d5c35207d931642c507b8fa089c6de28827a
MD5 f8bc1424e07b91925fa6d3eb65acafed
SHA1 9886b56f51cca607343ab3f33cb31ee3a1b1b599
SHA512 ba23c735274f9293a4e48f9e09f7eac8ec7f303df7a5724b9be668c255f399e3a8677dcbe349d09ced3d0d891b774d7ec97a6d6799d818d34450ad472f855fba
SSDEEP 6144:foYn9sE89XKTK/J6brj3nmHWrt63P5A9GJ6vbmF4ifKyjlKI4r3mzzrLVIo8ZJr6:ZsNDBIrCHWux6iFTJf4r2zPBv8Xi8xS
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1068-88-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1068-95-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1068-93-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1068-90-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1068-97-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1068-86-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1068-83-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1068-81-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1068-66-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1068-67-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1068-64-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1068-102-0x0000000000400000-0x000000000047B000-memory.dmp

Download

memory/1636-76-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1636-16-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1636-14-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1636-18-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/1636-55-0x0000000000400000-0x000000000040B000-memory.dmp

Download

memory/2016-77-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2016-49-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2016-51-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/2016-57-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/3116-0-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3116-5-0x0000000002420000-0x0000000002422000-memory.dmp

Download

memory/3116-3-0x00000000023D0000-0x00000000023D2000-memory.dmp

Download

memory/3116-22-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3116-13-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3116-4-0x00000000023F0000-0x00000000023F2000-memory.dmp

Download

memory/3156-56-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3156-74-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3156-44-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/3156-48-0x0000000000400000-0x000000000052D000-memory.dmp

Download

memory/4720-47-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4720-8-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4720-6-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4720-9-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4720-12-0x0000000000400000-0x000000000040C000-memory.dmp

Download

memory/4828-78-0x0000000000400000-0x000000000040B000-memory.dmp

Download