4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9

Analysis

max time kernel
92s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
14/11/2024, 01:57

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.exe
Size 48.2MB
Sample241114-cc9t2ashnr
SHA256 4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9
MD5 2d2f050e6c898065032cb2686a0effca
SHA1 0d3c1fbd9b7db74fdb5ee155b610d86319d9fa51
SHA512 5fcd58c259cd020f5b4afe8802a6588e7a942ef53cf5175f6f18c900e8ed7e6b5009370b0b0e06969e4ecc7c26dcd7e8f3318907411fc7df62ccb797ec04f67e
SSDEEP 786432:HyiiDc4ImIc9SLIJyNwsNBIRya++/sC89UTh/1m1OO2+3FJRYd17TV+s:SiiD9KL85sNBIRyX0M9gG1OO//2rh+s
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp
1336	7z.exe
3984	parsec-windows.exe

Loads dropped DLL 3 IoCs

pid	Process
1336	7z.exe
3984	parsec-windows.exe
3984	parsec-windows.exe

Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
discovery

Query Registry
T1012
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
defense_evasion

File Deletion
T1070.004

Looks up external IP address via web service 2 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
19	ifconfig.me
18	ifconfig.me

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	CMD.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	parsec-windows.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp

Script User-Agent 2 IoCs

Uses user-agent string associated with script host/environment.

description	flow	ioc
HTTP User-Agent header	19	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)
HTTP User-Agent header	21	Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5)

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp
1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	1336	7z.exe
Token: 35	1336	7z.exe
Token: SeSecurityPrivilege	1336	7z.exe
Token: SeSecurityPrivilege	1336	7z.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2028 wrote to memory of 1060	2028	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.exe	86
PID 2028 wrote to memory of 1060	2028	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.exe	86
PID 2028 wrote to memory of 1060	2028	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.exe	86
PID 1060 wrote to memory of 3916	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	101
PID 1060 wrote to memory of 3916	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	101
PID 1060 wrote to memory of 3916	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	101
PID 3916 wrote to memory of 1336	3916	CMD.exe	103
PID 3916 wrote to memory of 1336	3916	CMD.exe	103
PID 1060 wrote to memory of 4728	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	104
PID 1060 wrote to memory of 4728	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	104
PID 1060 wrote to memory of 4728	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	104
PID 1060 wrote to memory of 3552	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	106
PID 1060 wrote to memory of 3552	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	106
PID 1060 wrote to memory of 3552	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	106
PID 1060 wrote to memory of 3620	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	108
PID 1060 wrote to memory of 3620	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	108
PID 1060 wrote to memory of 3620	1060	4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp	108
PID 3620 wrote to memory of 3984	3620	cmd.exe	110
PID 3620 wrote to memory of 3984	3620	cmd.exe	110
PID 3620 wrote to memory of 3984	3620	cmd.exe	110

C:\Users\Admin\AppData\Local\Temp\4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.exe
"C:\Users\Admin\AppData\Local\Temp\4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2028
- C:\Users\Admin\AppData\Local\Temp\is-3A8FU.tmp\4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp
  "C:\Users\Admin\AppData\Local\Temp\is-3A8FU.tmp\4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp" /SL5="$80052,49640288,887296,C:\Users\Admin\AppData\Local\Temp\4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of WriteProcessMemory
  PID:1060
- - C:\Windows\SysWOW64\CMD.exe
    "CMD" /C "C:\Users\Admin\AppData\Roaming\PSecWin\SoundNight.7z.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3916
  - - C:\Users\Admin\AppData\Roaming\PSecWin\7z.exe
      "C:\Users\Admin\AppData\Roaming\PSecWin\7z.exe" x -aoa "C:\Users\Admin\AppData\Roaming\PSecWin\SoundNight.7z" -p"fa073db961c" -o"C:\Users\Admin\AppData\Roaming\PSecWin\"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of AdjustPrivilegeToken
      PID:1336
- - C:\Windows\SysWOW64\CMD.exe
    "CMD" /C del "C:\Users\Admin\AppData\Roaming\PSecWin\SoundNight.7z.bat"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4728
- - C:\Windows\SysWOW64\CMD.exe
    "CMD" /C del "SoundNight.7z"
    3⤵
    - System Location Discovery: System Language Discovery
    PID:3552
- - C:\Windows\SysWOW64\cmd.exe
    "cmd" /C "C:\Users\Admin\AppData\Roaming\PSecWin\parsec-windows.exe"
    3⤵
    - System Location Discovery: System Language Discovery
    - Suspicious use of WriteProcessMemory
    PID:3620
  - - C:\Users\Admin\AppData\Roaming\PSecWin\parsec-windows.exe
      C:\Users\Admin\AppData\Roaming\PSecWin\parsec-windows.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      System Location Discovery: System Language Discovery
      PID:3984

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Indicator Removal

T1070

File Deletion

T1070.004

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp

Path C:\Users\Admin\AppData\Local\Temp\is-3A8FU.tmp\4c750c11a04f90c9922ace4a237dc256d7e71fa512d4857922cc7d46bb4ba0e9.tmp
Size 3.1MB
SHA256 6f28dfb808d325740ae9189598ad4ab2d7e2b77293dcfbb7a6b00ac852b719df
MD5 828b7d7624c14be1f3d8122f6e2fac53
SHA1 1e51b52b0e6aa39bb4c465767e5131b99e39cab2
SHA512 e83136f55417d0ad0748a78faa7e9c88885520b4b596aca51b70f3816d21fd71112a0bd1e6968fb8cb22e5c3956b3ba0a5d20dacfc54f1eef3eab5fc7661ddcb
SSDEEP 49152:Odx4HDQNJL0VR6SgMt+k4RiP+RmXMjiINiMq95FoHVHNTQTEjy333zmgS:vHDYsqiPRhINnq95FoHVBy333CB
MD5 SHA1 SHA512 SSDEEP

Submit Download

System.dll

Path C:\Users\Admin\AppData\Local\Temp\nsfDE8A.tmp\System.dll
Size 12KB
SHA256 8dc562cda7217a3a52db898243de3e2ed68b80e62ddcb8619545ed0b4e7f65a8
MD5 cff85c549d536f651d4fb8387f1976f2
SHA1 d41ce3a5ff609df9cf5c7e207d3b59bf8a48530e
SHA512 531d6328daf3b86d85556016d299798fa06fefc81604185108a342d000e203094c8c12226a12bd6e1f89b0db501fb66f827b610d460b933bd4ab936ac2fd8a88
SSDEEP 192:Zjvco0qWTlt70m5Aj/lQ0sEWD/wtYbBHFNaDybC7y+XBz0QPi:FHQlt70mij/lQRv/9VMjzr
MD5 SHA1 SHA512 SSDEEP

Submit Download

nsDialogs.dll

Path C:\Users\Admin\AppData\Local\Temp\nsfDE8A.tmp\nsDialogs.dll
Size 9KB
SHA256 56b96add1978b1abba286f7f8982b0efbe007d4a48b3ded6a4d408e01d753fe2
MD5 6c3f8c94d0727894d706940a8a980543
SHA1 0d1bcad901be377f38d579aafc0c41c0ef8dcefd
SHA512 2094f0e4bb7c806a5ff27f83a1d572a5512d979eefda3345baff27d2c89e828f68466d08c3ca250da11b01fc0407a21743037c25e94fbe688566dd7deaebd355
SSDEEP 96:o0svUu3Uy+sytcS8176b+XR8pCHFcMcxSgB5PKtAtgt+Nt+rnt3DVEB3YcNqkzfS:o0svWyNO81b8pCHFcM0PuAgkOyuIFc
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.dll

Path C:\Users\Admin\AppData\Roaming\PSecWin\7z.dll
Size 1.8MB
SHA256 77222e81cb7004e8c3e077aada02b555a3d38fb05b50c64afd36ca230a8fd5b9
MD5 4e35a902ca8ed1c3d4551b1a470c4655
SHA1 ad9a9b5dbe810a6d7ea2c8430c32417d87c5930c
SHA512 c7966f892c1f81fbe6a2197bd229904d398a299c53c24586ca77f7f657529323e5a7260ed32da9701fce9989b0b9a2463cd45c5a5d77e56a1ea670e02e575a30
SSDEEP 24576:E8sHeHKHplfu94i55tbhris2CCEnWaWBvYyozGUIjnRnU:E8Y/Q94iZNrP2t0ZyyIjnRnU
MD5 SHA1 SHA512 SSDEEP

Submit Download

7z.exe

Path C:\Users\Admin\AppData\Roaming\PSecWin\7z.exe
Size 544KB
SHA256 8cebb25e240db3b6986fcaed6bc0b900fa09dad763a56fb71273529266c5c525
MD5 9a1dd1d96481d61934dcc2d568971d06
SHA1 f136ef9bf8bd2fc753292fb5b7cf173a22675fb3
SHA512 7ac1581f8a29e778ba1a1220670796c47fa5b838417f8f635e2cb1998a01515cff3ee57045dacb78a8ec70d43754b970743aba600379fe6d9481958d32d8a5aa
SSDEEP 6144:mE7cV3iwbAFRWAbd4nf0H05yqE6Hl0ChW0+ksllAXBu0lWGWUJJQ4t0BHQQf+L+G:d7a3iwbihym2g7XO3LWUQfh4Co
MD5 SHA1 SHA512 SSDEEP

Submit Download

SoundNight.7z

Path C:\Users\Admin\AppData\Roaming\PSecWin\SoundNight.7z
Size 3.6MB
SHA256 d009598d6f687532eb734a222d9c0d7eaa179655f736f7a7dd3a2dcb7fab4ad7
MD5 adf5c26373a00e49dfc8b59678a26851
SHA1 5e0d3e43187e8652fe6b7e898ad666c2939f3c38
SHA512 ada9e3c6a9eb49adccdc07d30b1a3994c84de0c9df93ec365d2396e0c06472c31a6fe2bba45930dc2b384dc36fff7d858f1692dce6dcf57a8543f7f86ca5d70e
SSDEEP 49152:SPX5+ecyESLsnN+9/mWfUrkNI7YXv4o4pZ54jEoET6aH2xIuueh26VmQ9FTdPTfQ:SPpLqm/mwUQNI7Zp8xTw6vRPTbSclMj
MD5 SHA1 SHA512 SSDEEP

Submit Download

SoundNight.7z.bat

Path C:\Users\Admin\AppData\Roaming\PSecWin\SoundNight.7z.bat
Size 169B
SHA256 0274fc00abbfb9e82b2d16b8339372d194f727e9251fda5eb942c2f80b9f9281
MD5 424f4e6c6f66d6d65bd2591506c9bd37
SHA1 ac1d759d10de2b9401d8d6a8d2fbdb5287a2b96a
SHA512 10378fd6ec1fb2500a82cc5fbdf45194b6c8885262751a753580970368156db7981851de130203c42db611a492aa1b181a81930331dbdaff93ade75d9938ea9c
MD5 SHA1 SHA512

Submit Download

SoundNight.7z.txt

Path C:\Users\Admin\AppData\Roaming\PSecWin\SoundNight.7z.txt
Size 20B
SHA256 dca33c88066644ee5a99aece0dee86830ad7811aaddf677e514f4c08ae578cb5
MD5 d2ec38a2f034052124abc5de27a0cf08
SHA1 198cece15dda469855fabacc38041a04626eda24
SHA512 7d9859168435276ecdcaff43906af949ae9863a11e30d74965e88c64a06d951723dfc1bad5641474c24ff13079fa7d0142d18b89f88f6fba7dac499f1c6d501f
MD5 SHA1 SHA512

Submit Download

parsec-windows.exe

Path C:\Users\Admin\AppData\Roaming\PSecWin\parsec-windows.exe
Size 3.9MB
SHA256 ae5b66322e5a7c26ad21ccc556bdc1618796166565d2939142c5aa3d76c38ace
MD5 01ef58e7c144c701b2ea01cfc049dbe4
SHA1 2f572accb519096c9ea805812ba53703c16cceea
SHA512 434fd6d4eb49669617da3a15c2239a2cf524624cc4fcf9f09d8bb78a40ddf2dc5e70105e6708ce7643448f3176301edd64a9b71244c179a836119532d7dd69a6
SSDEEP 98304:QsSoMQnPLeMNCvYa59QKS7XnqSsAVlsX4pIDmjjcrhm2NGbUU:QsSByeMj04VlslQsm2NK
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1060-10-0x0000000000400000-0x0000000000721000-memory.dmp

Download

memory/1060-6-0x0000000000400000-0x0000000000721000-memory.dmp

Download

memory/1060-136-0x0000000000400000-0x0000000000721000-memory.dmp

Download

memory/2028-8-0x0000000000400000-0x00000000004E6000-memory.dmp

Download

memory/2028-0-0x0000000000400000-0x00000000004E6000-memory.dmp

Download

memory/2028-2-0x0000000000401000-0x00000000004B7000-memory.dmp

Download

memory/2028-137-0x0000000000400000-0x00000000004E6000-memory.dmp

Download