Analysis

  • max time kernel
    94s
  • max time network
    96s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20241007-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
  • submitted
    13-11-2024 09:38

General

  • Target

    2dff8c8875b3244143e5dcb63aa94985f4ef1650a1bcef446d50341a9424949c.exe

  • Size

    9.6MB

  • MD5

    8168594bee79378e25b371736d38c0ae

  • SHA1

    959da3e13bdd1138ad2a86b724bd1280f405d873

  • SHA256

    2dff8c8875b3244143e5dcb63aa94985f4ef1650a1bcef446d50341a9424949c

  • SHA512

    f03ac700f20582f5ad5f16be396e81a21a8864c77333c53784aeab376073ccd5ba8f4a8c1482d817e2ca73b983dfb2cff4b4cf449081dbdcb5cda2305e75b08b

  • SSDEEP

    196608:wJEUqNdLdxriGIQPWbHklWs1lUYiqz+OxAvQ0qRt95CnqjkfiHGZOcVIS9fQf:eEUqNdLdxrHIQPWIlMqz+OxAvWRt95Cg

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Drops startup file 1 IoCs
  • Executes dropped EXE 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 6 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Delays execution with timeout.exe 1 IoCs
  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\2dff8c8875b3244143e5dcb63aa94985f4ef1650a1bcef446d50341a9424949c.exe
    "C:\Users\Admin\AppData\Local\Temp\2dff8c8875b3244143e5dcb63aa94985f4ef1650a1bcef446d50341a9424949c.exe"
    1⤵
    • Checks computer location settings
    • Drops startup file
    • System Location Discovery: System Language Discovery
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4132
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "powershell.exe" Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\Conventer.exe'
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4672
    • C:\Windows\SysWOW64\schtasks.exe
      "schtasks.exe" /create /tn Conventer /tr "C:\Users\Admin\AppData\Local\Temp\Conventer.exe\SeedPhrase Converter.exe" /st 09:43 /du 23:59 /sc daily /ri 1 /f
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:3792
    • C:\Users\Admin\AppData\Local\Temp\Conventer.exe\SeedPhrase Converter.exe
      "C:\Users\Admin\AppData\Local\Temp\Conventer.exe\SeedPhrase Converter.exe"
      2⤵
      • Executes dropped EXE
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: AddClipboardFormatListener
      • Suspicious use of AdjustPrivilegeToken
      PID:2568
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c ""C:\Users\Admin\AppData\Local\Temp\tmp9069.tmp.cmd""
      2⤵
      • System Location Discovery: System Language Discovery
      • Suspicious use of WriteProcessMemory
      PID:4872
      • C:\Windows\SysWOW64\timeout.exe
        timeout 6
        3⤵
        • System Location Discovery: System Language Discovery
        • Delays execution with timeout.exe
        PID:2800

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\Conventer.exe\SeedPhrase Converter.exe

    Filesize

    10.2MB

    MD5

    426204109bb4aa0d1f70472b65c40412

    SHA1

    8bc861d2e04c0ca9f3adbb5585bda6fe8ea06bb4

    SHA256

    c33464f3642fdd812f4f529d3751be4b46aced6807616106b36fd7abae1a8de2

    SHA512

    3354c5aef2edcf3e561f6ba2054b83636d8c63010a3149742b4d601e74a69fc426b1203a4117eaf26ac28e0dd3b8e663efab6051b202382a7b546b6691b5647d

  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_vzskzffy.4mx.ps1

    Filesize

    60B

    MD5

    d17fe0a3f47be24a6453e9ef58c94641

    SHA1

    6ab83620379fc69f80c0242105ddffd7d98d5d9d

    SHA256

    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

    SHA512

    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

  • C:\Users\Admin\AppData\Local\Temp\tmp9069.tmp.cmd

    Filesize

    216B

    MD5

    bb7c08ea7749cb0b92b3ad665aade848

    SHA1

    df15a354a25fbd5cf5726ff9e64bb641ed6d1e09

    SHA256

    43bf31aff72d16b2d09e8346c8060c35987916a72aafd65e244dae105e09e22b

    SHA512

    6b89b9c65a76a58bcbc267a94b9d419c8780bf84928a4d29652e4330315afc594ee87332076768c70af4bb3e46192244de87aca5ebf034a44a15fc030d45ac0b

  • memory/2568-69-0x0000000074C40000-0x00000000753F0000-memory.dmp

    Filesize

    7.7MB

  • memory/2568-65-0x0000000005840000-0x000000000584A000-memory.dmp

    Filesize

    40KB

  • memory/2568-39-0x0000000074C40000-0x00000000753F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4132-1-0x0000000000C70000-0x0000000000C8C000-memory.dmp

    Filesize

    112KB

  • memory/4132-2-0x0000000005D60000-0x0000000006304000-memory.dmp

    Filesize

    5.6MB

  • memory/4132-3-0x00000000056A0000-0x0000000005732000-memory.dmp

    Filesize

    584KB

  • memory/4132-0-0x0000000074C4E000-0x0000000074C4F000-memory.dmp

    Filesize

    4KB

  • memory/4672-41-0x0000000005CE0000-0x0000000005CFE000-memory.dmp

    Filesize

    120KB

  • memory/4672-56-0x0000000007650000-0x0000000007CCA000-memory.dmp

    Filesize

    6.5MB

  • memory/4672-22-0x00000000056B0000-0x0000000005716000-memory.dmp

    Filesize

    408KB

  • memory/4672-21-0x0000000005640000-0x00000000056A6000-memory.dmp

    Filesize

    408KB

  • memory/4672-37-0x0000000005720000-0x0000000005A74000-memory.dmp

    Filesize

    3.3MB

  • memory/4672-19-0x0000000074C40000-0x00000000753F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4672-12-0x0000000074C40000-0x00000000753F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4672-42-0x0000000005D30000-0x0000000005D7C000-memory.dmp

    Filesize

    304KB

  • memory/4672-9-0x0000000074C40000-0x00000000753F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4672-43-0x00000000062C0000-0x00000000062F2000-memory.dmp

    Filesize

    200KB

  • memory/4672-44-0x0000000072530000-0x000000007257C000-memory.dmp

    Filesize

    304KB

  • memory/4672-54-0x0000000006EB0000-0x0000000006ECE000-memory.dmp

    Filesize

    120KB

  • memory/4672-55-0x0000000006EE0000-0x0000000006F83000-memory.dmp

    Filesize

    652KB

  • memory/4672-20-0x00000000055A0000-0x00000000055C2000-memory.dmp

    Filesize

    136KB

  • memory/4672-57-0x0000000007010000-0x000000000702A000-memory.dmp

    Filesize

    104KB

  • memory/4672-58-0x0000000007080000-0x000000000708A000-memory.dmp

    Filesize

    40KB

  • memory/4672-59-0x0000000007290000-0x0000000007326000-memory.dmp

    Filesize

    600KB

  • memory/4672-60-0x0000000007210000-0x0000000007221000-memory.dmp

    Filesize

    68KB

  • memory/4672-61-0x0000000007240000-0x000000000724E000-memory.dmp

    Filesize

    56KB

  • memory/4672-62-0x0000000007250000-0x0000000007264000-memory.dmp

    Filesize

    80KB

  • memory/4672-63-0x0000000007350000-0x000000000736A000-memory.dmp

    Filesize

    104KB

  • memory/4672-64-0x0000000007330000-0x0000000007338000-memory.dmp

    Filesize

    32KB

  • memory/4672-10-0x0000000004F70000-0x0000000005598000-memory.dmp

    Filesize

    6.2MB

  • memory/4672-68-0x0000000074C40000-0x00000000753F0000-memory.dmp

    Filesize

    7.7MB

  • memory/4672-6-0x00000000023C0000-0x00000000023F6000-memory.dmp

    Filesize

    216KB