Analysis
- max time kernel
139s - max time network
147s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
- submitted
13/11/2024, 16:25
General
- Target 600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5.exe
- Size 3.9MB
- Sample241113-txchpsvhnr
- SHA256 600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5
Malware Config
Signatures
- Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
- Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
- Loads dropped DLL 4 IoCs
- Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
- Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
- System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
- Suspicious behavior: EnumeratesProcesses 2 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5.exe"C:\Users\Admin\AppData\Local\Temp\600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5.exe"1⤵
- Checks computer location settings
- Loads dropped DLL
- Writes to the Master Boot Record (MBR)
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionProcess "C:\Users\Admin\AppData\Local\Temp\600765788bb1c6f1add66b67ea9c4f59aa3581ff523f7c770d346b979c775fd5.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
__PSScriptPolicyTest_5xodteus.dwp.ps1
360Base.dll
360NetBase.dll
360P2SP.dll
checkbox.png
radio.png
MiniUI.dll
MiniUI.xml
memory/3528-26-0x0000000004F40000-0x0000000004F62000-memory.dmp
memory/3528-86-0x0000000006E90000-0x0000000006F33000-memory.dmp
memory/3528-28-0x0000000005810000-0x0000000005876000-memory.dmp
memory/3528-38-0x0000000005880000-0x0000000005BD4000-memory.dmp
memory/3528-39-0x0000000005E90000-0x0000000005EAE000-memory.dmp
memory/3528-40-0x0000000005ED0000-0x0000000005F1C000-memory.dmp
memory/3528-27-0x0000000005790000-0x00000000057F6000-memory.dmp
memory/3528-16-0x00000000736C0000-0x0000000073E70000-memory.dmp
memory/3528-4-0x0000000004F70000-0x0000000005598000-memory.dmp
memory/3528-5-0x00000000736C0000-0x0000000073E70000-memory.dmp
memory/3528-3-0x0000000004900000-0x0000000004936000-memory.dmp
memory/3528-73-0x0000000006470000-0x00000000064A2000-memory.dmp
memory/3528-84-0x00000000736C0000-0x0000000073E70000-memory.dmp
memory/3528-85-0x0000000006E70000-0x0000000006E8E000-memory.dmp
memory/3528-74-0x000000006F970000-0x000000006F9BC000-memory.dmp
memory/3528-1-0x00000000736CE000-0x00000000736CF000-memory.dmp
memory/3528-87-0x00000000736C0000-0x0000000073E70000-memory.dmp
memory/3528-88-0x00000000736C0000-0x0000000073E70000-memory.dmp
memory/3528-90-0x00000000071C0000-0x00000000071DA000-memory.dmp
memory/3528-89-0x0000000007810000-0x0000000007E8A000-memory.dmp
memory/3528-91-0x0000000007230000-0x000000000723A000-memory.dmp
memory/3528-92-0x0000000007440000-0x00000000074D6000-memory.dmp
memory/3528-93-0x00000000073C0000-0x00000000073D1000-memory.dmp
memory/3528-94-0x00000000073F0000-0x00000000073FE000-memory.dmp
memory/3528-95-0x0000000007400000-0x0000000007414000-memory.dmp
memory/3528-96-0x0000000007500000-0x000000000751A000-memory.dmp
memory/3528-97-0x00000000074E0000-0x00000000074E8000-memory.dmp
memory/3528-100-0x00000000736C0000-0x0000000073E70000-memory.dmp
memory/3584-101-0x0000000004350000-0x0000000004351000-memory.dmp
memory/3584-102-0x0000000004350000-0x0000000004351000-memory.dmp