Analysis
-
max time kernel
94s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-11-2024 10:08
Static task
static1
Behavioral task
behavioral1
Sample
62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe
Resource
win7-20240729-en
General
-
Target
62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe
-
Size
2.8MB
-
MD5
ffbf297cf07adacc64c1072b7fc45ad3
-
SHA1
5e6fd2a7b3eb6128d2c6ca0caa8ec5e2f39e4cc3
-
SHA256
62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c
-
SHA512
f4fe1b6bbe7557eb276896301fd0516bfc24cfc4284d1487691ef531e466a8ec272a83627ff8f774dbe3657ff0dfd69a0842982fa0868757a48c290c25aab9a9
-
SSDEEP
49152:q2nABX4VY5eEUIag7UK5bfl9GJuFxBGDw9CJpMQ9pOgQ6NIpdcD4HV:q2ABXcY5eEU8HbvGJu4DwmzOgQZpdcDO
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-4089630652-1596403869-279772308-1000\Control Panel\International\Geo\Nation 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe -
Drops startup file 1 IoCs
Processes:
62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exedescription ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\apihost.exe.lnk 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe -
Executes dropped EXE 1 IoCs
Processes:
apihost.exepid Process 1380 apihost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
apihost.execmd.exetimeout.exe62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exeschtasks.exepowershell.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language apihost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language timeout.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Delays execution with timeout.exe 1 IoCs
Processes:
timeout.exepid Process 4444 timeout.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: AddClipboardFormatListener 1 IoCs
Processes:
apihost.exepid Process 1380 apihost.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
powershell.exepid Process 896 powershell.exe 896 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exepowershell.exeapihost.exedescription pid Process Token: SeDebugPrivilege 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe Token: SeDebugPrivilege 896 powershell.exe Token: SeDebugPrivilege 1380 apihost.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.execmd.exedescription pid Process procid_target PID 2668 wrote to memory of 744 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 87 PID 2668 wrote to memory of 744 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 87 PID 2668 wrote to memory of 744 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 87 PID 2668 wrote to memory of 896 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 88 PID 2668 wrote to memory of 896 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 88 PID 2668 wrote to memory of 896 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 88 PID 2668 wrote to memory of 1380 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 91 PID 2668 wrote to memory of 1380 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 91 PID 2668 wrote to memory of 1380 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 91 PID 2668 wrote to memory of 3672 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 92 PID 2668 wrote to memory of 3672 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 92 PID 2668 wrote to memory of 3672 2668 62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe 92 PID 3672 wrote to memory of 4444 3672 cmd.exe 94 PID 3672 wrote to memory of 4444 3672 cmd.exe 94 PID 3672 wrote to memory of 4444 3672 cmd.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe"C:\Users\Admin\AppData\Local\Temp\62bf1c22cfff5676af918e964e59f5a49c9afc77bc166ac106087458e0bd932c.exe"1⤵
- Checks computer location settings
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /tn AccSys /tr "C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe" /st 10:13 /du 23:59 /sc daily /ri 1 /f2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:744
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Roaming\ACCApi'2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896
-
-
C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe"C:\Users\Admin\AppData\Roaming\ACCApi\apihost.exe"2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of AdjustPrivilegeToken
PID:1380
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmpCDFE.tmp.cmd""2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3672 -
C:\Windows\SysWOW64\timeout.exetimeout 63⤵
- System Location Discovery: System Language Discovery
- Delays execution with timeout.exe
PID:4444
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
60B
MD5d17fe0a3f47be24a6453e9ef58c94641
SHA16ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA25696ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
SHA5125b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
-
Filesize
216B
MD582b0d0b98772b32c87832b03a2a80a83
SHA1f9641e74867e6783b7594afb8216f2d964373191
SHA25676e5417946c1ff1a7c89ac8ce327d2abc14aaec7b0ba39752e1608263744f9b3
SHA512e1f6542878bd15cb026dd426a0a16894fd268c669aca08cbbd63678604f3964f113fee57bde5cd3335e0463d20cc98990307db221c2c97323dc10a0523340735
-
Filesize
2.9MB
MD538b160906dd4aa4d6cade1699c8a13f4
SHA1779180b1cd6e064195de8e866bcb46cdce876f3d
SHA256285aa5d7f1e59f988f7868705314feb65d247c181556d1b6af7fb00be33db719
SHA512ada4b1c58cab09c995b185c618ac9d66326ff4a6df340dbc5f77a89b986eea627f4b2e2194963bb393b138623a55f5b9ceb37d1a72593d5ca3a3ac1c1cec45e9