774368536ee17949132b38f6067b9b6aea5362c1f23fb06410b4e8cec4c2ed5c

Analysis

max time kernel
150s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
10/11/2024, 08:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
OtherBahamas.exe
Size 1.0MB
Sample241110-j69vfsshqq
SHA256 774368536ee17949132b38f6067b9b6aea5362c1f23fb06410b4e8cec4c2ed5c
MD5 830fb00f35661bfe1b89e71f3e6e1525
SHA1 3779f329733b94693f33cf3b6052c3433540bf7e
SHA512 9f8fd6f16a6f6ce2ad24f54c60667ca6bf3909b5f7d5d3fedbbe95259065d91f39031fd399fc8d22ee4f82a06a69298a289084f4e56b133761c441930d241bcb
SSDEEP 24576:IbmNIA+DEH0TjoyA1JtlU2rUzrJ9B2Zg6kZuEUYDtaaX:smKeH0/oyAP3ErWgbZ8utaaX
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2045521122-590294423-3465680274-1000\Control Panel\International\Geo\Nation	OtherBahamas.exe

Executes dropped EXE 1 IoCs

pid	Process
4328	Symptoms.pif

Enumerates processes with tasklist 1 TTPs 2 IoCs

discovery

Process Discovery

T1057

pid	Process
4840	tasklist.exe
2840	tasklist.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\ResultingCambridge	OtherBahamas.exe
File opened for modification	C:\Windows\AppliesImprovement	OtherBahamas.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 11 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	choice.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tasklist.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	OtherBahamas.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	findstr.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Symptoms.pif

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
4328	Symptoms.pif
4328	Symptoms.pif
4328	Symptoms.pif
4328	Symptoms.pif
4328	Symptoms.pif
4328	Symptoms.pif

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	4840	tasklist.exe
Token: SeDebugPrivilege	2840	tasklist.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4328	Symptoms.pif
4328	Symptoms.pif
4328	Symptoms.pif

Suspicious use of SendNotifyMessage 3 IoCs

pid	Process
4328	Symptoms.pif
4328	Symptoms.pif
4328	Symptoms.pif

Suspicious use of WriteProcessMemory 30 IoCs

description	pid	Process	procid_target
PID 1692 wrote to memory of 3924	1692	OtherBahamas.exe	84
PID 1692 wrote to memory of 3924	1692	OtherBahamas.exe	84
PID 1692 wrote to memory of 3924	1692	OtherBahamas.exe	84
PID 3924 wrote to memory of 4840	3924	cmd.exe	90
PID 3924 wrote to memory of 4840	3924	cmd.exe	90
PID 3924 wrote to memory of 4840	3924	cmd.exe	90
PID 3924 wrote to memory of 884	3924	cmd.exe	91
PID 3924 wrote to memory of 884	3924	cmd.exe	91
PID 3924 wrote to memory of 884	3924	cmd.exe	91
PID 3924 wrote to memory of 2840	3924	cmd.exe	94
PID 3924 wrote to memory of 2840	3924	cmd.exe	94
PID 3924 wrote to memory of 2840	3924	cmd.exe	94
PID 3924 wrote to memory of 3392	3924	cmd.exe	95
PID 3924 wrote to memory of 3392	3924	cmd.exe	95
PID 3924 wrote to memory of 3392	3924	cmd.exe	95
PID 3924 wrote to memory of 3916	3924	cmd.exe	97
PID 3924 wrote to memory of 3916	3924	cmd.exe	97
PID 3924 wrote to memory of 3916	3924	cmd.exe	97
PID 3924 wrote to memory of 2532	3924	cmd.exe	98
PID 3924 wrote to memory of 2532	3924	cmd.exe	98
PID 3924 wrote to memory of 2532	3924	cmd.exe	98
PID 3924 wrote to memory of 2504	3924	cmd.exe	99
PID 3924 wrote to memory of 2504	3924	cmd.exe	99
PID 3924 wrote to memory of 2504	3924	cmd.exe	99
PID 3924 wrote to memory of 4328	3924	cmd.exe	100
PID 3924 wrote to memory of 4328	3924	cmd.exe	100
PID 3924 wrote to memory of 4328	3924	cmd.exe	100
PID 3924 wrote to memory of 2828	3924	cmd.exe	101
PID 3924 wrote to memory of 2828	3924	cmd.exe	101
PID 3924 wrote to memory of 2828	3924	cmd.exe	101

C:\Users\Admin\AppData\Local\Temp\OtherBahamas.exe
"C:\Users\Admin\AppData\Local\Temp\OtherBahamas.exe"
1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1692
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy Msgstr Msgstr.bat & Msgstr.bat
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:3924
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:4840
- - C:\Windows\SysWOW64\findstr.exe
    findstr /I "wrsa opssvc"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:884
- - C:\Windows\SysWOW64\tasklist.exe
    tasklist
    3⤵
    - Enumerates processes with tasklist
    - System Location Discovery: System Language Discovery
    - Suspicious use of AdjustPrivilegeToken
    PID:2840
- - C:\Windows\SysWOW64\findstr.exe
    findstr -I "avastui avgui bdservicehost nswscsvc sophoshealth"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3392
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c md 54284
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3916
- - C:\Windows\SysWOW64\findstr.exe
    findstr /V "CALCULATIONINDJAVASCRIPTPOPULATIONS" Finding
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2532
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c copy /b ..\Style + ..\Oregon + ..\Rental + ..\Matter + ..\Extras + ..\Weeks + ..\Broken e
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2504
- - C:\Users\Admin\AppData\Local\Temp\54284\Symptoms.pif
    Symptoms.pif e
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of FindShellTrayWindow
    - Suspicious use of SendNotifyMessage
    PID:4328
- - C:\Windows\SysWOW64\choice.exe
    choice /d y /t 5
    3⤵
    - System Location Discovery: System Language Discovery
    PID:2828

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Process Discovery

T1057

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Symptoms.pif

Path C:\Users\Admin\AppData\Local\Temp\54284\Symptoms.pif
Size 921KB
SHA256 05d8cf394190f3a707abfb25fb44d7da9d5f533d7d2063b23c00cc11253c8be7
MD5 78ba0653a340bac5ff152b21a83626cc
SHA1 b12da9cb5d024555405040e65ad89d16ae749502
SHA512 efb75e4c1e0057ffb47613fd5aae8ce3912b1558a4b74dbf5284c942eac78ecd9aca98f7c1e0e96ec38e8177e58ffdf54f2eb0385e73eef39e8a2ce611237317
SSDEEP 24576:FJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:FC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Path C:\Users\Admin\AppData\Local\Temp\54284\e
Size 494KB
SHA256 57190c767819405318e178627d73ef916e5f9a4eb81b1f5c4049be8f24117577
MD5 238b1c4ca5dc8fa14dfd82571999b3c5
SHA1 4b96f7d1a5456e40da6ac814af97b5c47dca6dd9
SHA512 f71ff62184193ddbfc3d77a650c47654fa8cf7014cbb55cfd7796c391c16a0d19e950b5daa4287bf236d9427666bf5af2ad08afe5da4e89bac673e8b585e3356
SSDEEP 12288:mMB8KlugjVGHWz27P8aMdF4fqqEc0Njfnvn2v:jugjfNv7qEcknuv
MD5 SHA1 SHA512 SSDEEP

Submit Download

Across

Path C:\Users\Admin\AppData\Local\Temp\Across
Size 910KB
SHA256 402282660e7477e4f6066d41789caa2a0a364e9762db99fa235cc56a92f00906
MD5 5aaff30d202790c5124104a048193477
SHA1 e82811dccf55d874c061b8f24a090b8db2bdb1c2
SHA512 c1955efd3aaf724a7089a26134bb8dbad022083f364b4df6ca22268357ceb83fc60a3265b494151553167cc37ad948e12c9ee7120862aa87283b5a96663089a9
SSDEEP 24576:hJs7DlG83U/hcSO3UTyYPeuZtxY+8aiB8ea:hC7hGOSPT/PxebaiO
MD5 SHA1 SHA512 SSDEEP

Submit Download

Broken

Path C:\Users\Admin\AppData\Local\Temp\Broken
Size 14KB
SHA256 bee83480f1475de0ff08ac5be918268a627efe300d316e146a38cd0bfe9b087d
MD5 492e925a00ccb064f4bd03df23bc7ca8
SHA1 14234265a0566ed9dcc541a880552755bbc0c138
SHA512 c6005412faa11ef8eaedf71c1bade5b96584866dea001118accd7682cc553ff60e762f14ef1251bd99a3502fc1322286328a130657e51cabd63cf43e698066d2
SSDEEP 384:7N84QWEYLJcrNqtEIt/EWDoR9TxbEj01VghJ7R:C6EYLWrMtLt8WDoR9S01VWJV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Extras

Path C:\Users\Admin\AppData\Local\Temp\Extras
Size 95KB
SHA256 cf6a6f09dd48fc02b4e594d0c40ee9d187a08134b4f6c92c8d049e301d3143ae
MD5 40e054b2fe65fd8a2d65a88666895aa5
SHA1 680c23cdb0801c796ab1ed3441b196c298392079
SHA512 6c1ca7030290be5c0c06021f3cffd94e287956cd2b819bdc307fcf6c8570653920d4ed59706edc0fccf3365c1873877e6a7d8386c3b54ea3a80f88354527a135
SSDEEP 1536:8l7Oen3N2G4gMuPpbNIRSpwbYXMqcmZC2TgqI7eEMfW26iavXSuVdSGLt:8l6mN2KpqRSp1fZZ8qEcfW2aSASWt
MD5 SHA1 SHA512 SSDEEP

Submit Download

Finding

Path C:\Users\Admin\AppData\Local\Temp\Finding
Size 10KB
SHA256 2c996ca1f4215993cd66edd625b5e4f24430bb0fb12bf9e9d2f5224d6c400450
MD5 cbca6840f075eb47cfba5eaf19f3a148
SHA1 fcce5e5292aabf4ad9fb988a64213e196f811a96
SHA512 caec22d6faa174955d84db5e09e3915098a5c834f76f87bbc987805c523c33d8e62e9c92a98bdab3a44d99bf22402adef11de3c313c1a97a5a8879312211d628
SSDEEP 192:Pk5lFWpOqoPzWaJNMqWzULI7NNiPN3UEdcQMMKAVhSo0QfLPlUZOZcP/ucHUe:ulFuOqohnWzR7NNilkEdpMMKAdbLPlUR
MD5 SHA1 SHA512 SSDEEP

Submit Download

Matter

Path C:\Users\Admin\AppData\Local\Temp\Matter
Size 67KB
SHA256 c01322c72b4215c86a5c89b969e029aff3998567746e51e9caddf02a60bc8f74
MD5 5c602d94a0de6a68d015debc66335919
SHA1 675f2a61a2bc8f0081a08128cb1105096b681343
SHA512 c223376f10ad83d15b55b587bf54900a03f4408970d7f4e299074f11d714228f001c59a1cd0e67a54296b74079dd721b8643050242e60879733d7a2b2b164ce0
SSDEEP 1536:TMWq5V7xN0QYqAz1B86wJCPAkw49sn3Z2YvXKzHvJ5nBP:IDNPAL7wJCPAzCwc8azPJT
MD5 SHA1 SHA512 SSDEEP

Submit Download

Msgstr

Path C:\Users\Admin\AppData\Local\Temp\Msgstr
Size 12KB
SHA256 4904408ff886704e9397e5f612d15bc889c1af1a5d442549d7cc01913696103d
MD5 0229a4bf1171595dff99c47294059ee0
SHA1 884df1569746f71e91b1d71f578d55191295f145
SHA512 3436c24a19d7cfec177767d7d2ffeacaf3d9be5bb8f7936e1da2f5b8a8f617b8e7c56726e0626e0911eb61ce5b5eb450c4c09356e093d25578389587256c1175
SSDEEP 384:LxfNTRvF+cAWk57bTrmJbx/DEoKKni9trUnN:FNTRdhHQ/gVhKKijwnN
MD5 SHA1 SHA512 SSDEEP

Submit Download

Oregon

Path C:\Users\Admin\AppData\Local\Temp\Oregon
Size 77KB
SHA256 3a5facc7e18e3a55dccc0d599a3ee4b9035894e618ed24ba2b4d3f7873e40ce3
MD5 a116f4a90b12940b7ba2707ed7582bbd
SHA1 77ed150b163d8dd53015d2b67e09993c456b1ae0
SHA512 ee258a449c285c91b7e6fa9ee0a2c2a0a101b9800e23d82ad7c1cbf413e3e13996908c2d3317bfdf5bfb9261c604fac0d6ccf6587f68aaace528d07b462bd260
SSDEEP 1536:Zc46WNqfvR/JqJcm4ZJipN3xEYWIo0CzT50TEEzjbp+5I9GQIaz0G5ETD/W:mHHGcmXPBEYRZE50wgj05GGJaIND+
MD5 SHA1 SHA512 SSDEEP

Submit Download

Rental

Path C:\Users\Admin\AppData\Local\Temp\Rental
Size 94KB
SHA256 64bd6dfe0a0bb31b3398c11710fa6920813ac6c0cbf3947d618425cf107c81fb
MD5 80e976fc19e09fcd78c963d16568cb45
SHA1 bed416accbe9f70a909d11118fc6930699838b91
SHA512 46a1e5a0fa8ef1fc142f9af89a74bb7d02cb29990f37f1608811424a6e0f676e1683b1e6f6d1afd4331236c1985fc1b73e04ebe7d08e425e8bc2086eb185b9f1
SSDEEP 1536:HU5jeDjf33ZF1JGgAL4f3L88YpW0hlQC5EHPTRVuryG5Ima4DqyFeR:+ji/1cgQ4fYRQC5ITRV284D1E
MD5 SHA1 SHA512 SSDEEP

Submit Download

Style

Path C:\Users\Admin\AppData\Local\Temp\Style
Size 83KB
SHA256 4895b84f8c6c0b0b35029ca7b59d191933123667ceeebbd5b694a33129826c1c
MD5 6cba8711c4a0b3b3d9317fb104c5db0e
SHA1 66e5e4b740b69481ed4513a79c8562531d1edd47
SHA512 bfafaa858d741e293b8ea8f778f349aaa9174b34930c0568563c70247a342e5274756e6c3f4ec8400237e5ec0e58f19b780c65256f498af1449106a3b0f9fd47
SSDEEP 1536:2/KWnMlTA2pYzzS9AMJ2sI8Tzmf6dNjOnO51wfRfYDSUJZpUqV:2/KJhfqQ2sI8TzmfUN4fRfiZaqV
MD5 SHA1 SHA512 SSDEEP

Submit Download

Weeks

Path C:\Users\Admin\AppData\Local\Temp\Weeks
Size 64KB
SHA256 be2876290464d40e12e7a5c0332a2d80a1ba915735e3b2ba64d97f301c58cd06
MD5 213b8783f5622647cbd61013ef765c65
SHA1 25b978946ee39fbcf48a9d1ab23552f2d40f99fc
SHA512 1dee0901642f7bb0e73ac302e4b307802c8f3574ad20bd6ad8a46ebe07a26770193f6cdb49436007d5c6f0c3a709a601589ea4256c9a19402f87151e1be537d5
SSDEEP 1536:5mQaEBE6PZO80A2ZC1DDyDWEo+KOYz/eCw+hklWMnjV:5aCEmXB1DSE+KnzLh4WAV
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/4328-319-0x00000000048E0000-0x0000000004938000-memory.dmp

Download

memory/4328-320-0x00000000048E0000-0x0000000004938000-memory.dmp

Download

memory/4328-324-0x00000000048E0000-0x0000000004938000-memory.dmp

Download

memory/4328-323-0x00000000048E0000-0x0000000004938000-memory.dmp

Download

memory/4328-322-0x00000000048E0000-0x0000000004938000-memory.dmp

Download

memory/4328-321-0x00000000048E0000-0x0000000004938000-memory.dmp

Download