0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5

Analysis

max time kernel
94s
max time network
134s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
11/11/2024, 12:45

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe
Size 201KB
Sample241111-py2f1azalk
SHA256 0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5
MD5 38b7e50d223af5f3cc065b1ec7487277
SHA1 f4b276828ee14a40a97a7f309c435f466fb9ac87
SHA512 1549c7420ee11e9094bf31b5a144ab3e655e214e743539b409b0b41482ff46138a35f33cf60a948d8db2122e041f1ff50b655421837c631d1c3975145a24ad7a
SSDEEP 768:H9sv5j2vQ/ymQq76dGMi0vErl/yWZkbJ1Vv5nzjh6XvvoFoCyt1yxEZR6Xo7:dsBivQ6mt7Ic03hj3ytYxyIs
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery persistence

Malware Config

Signatures

Boot or Logon Autostart Execution: Active Setup 2 TTPs 2 IoCs

Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.

persistence

Active Setup

T1547.014

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\3614402243784737	0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\3614402243784737\stubpath = "C:\\Program Files\\Common Files\\Apple\\Mobile Device Support\\apple.exe"	0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files\Common Files\Apple\Mobile Device Support\apple.exe	0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe
File opened for modification	C:\Program Files\Common Files\Apple\Mobile Device Support\apple.exe	0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 364 wrote to memory of 216	364	0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe	85
PID 364 wrote to memory of 216	364	0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe	85
PID 364 wrote to memory of 216	364	0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe	85
PID 364 wrote to memory of 4400	364	0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe	97
PID 364 wrote to memory of 4400	364	0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe	97
PID 364 wrote to memory of 4400	364	0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe	97

C:\Users\Admin\AppData\Local\Temp\0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe
"C:\Users\Admin\AppData\Local\Temp\0ad8db226d32c9b6e304552ce8f3af7663d6c82980e516f4a07c128e2eb55bd5.exe"
1⤵
- Boot or Logon Autostart Execution: Active Setup
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:364
- C:\Windows\SysWOW64\reg.exe
  reg delete "HKEY_CURRENT_USER\Software\Microsoft\Active Setup\Installed Components\3614402243784737" /f
  2⤵
  - System Location Discovery: System Language Discovery
  PID:216
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Users\Admin\AppData\Local\Temp\1.bat
  2⤵
  - System Location Discovery: System Language Discovery
  PID:4400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Active Setup

T1547.014

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.bat

Path C:\Users\Admin\AppData\Local\Temp\1.bat
Size 133B
SHA256 7384d731390de7ecc588a1aadf77fc4244ff9ecf3e618f4b505e47b6e218280c
MD5 07c55247fd9e8ad5cb866186ea6b5339
SHA1 8a48049ee19eaf4b5a9095de677e35ed8246f3d7
SHA512 514f3e154348cc2b01ee8d6b64bc8f994a0f474d2b76806ac956cf8b4f13eceb602edf0c678b23c6241abbc3c659338fa063bd2f2a706fb85c144ee211244e7c
MD5 SHA1 SHA512

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads