Analysis
-
max time kernel
111s -
max time network
96s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
14-11-2024 02:21
Static task
static1
Behavioral task
behavioral1
Sample
49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe
Resource
win7-20241023-en
Behavioral task
behavioral2
Sample
49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe
Resource
win10v2004-20241007-en
General
-
Target
49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe
-
Size
75KB
-
MD5
bc6b454fd9aa7c4bed3337850e889490
-
SHA1
f9cbf696ce757f0a1146f2f77fc7143766a382f1
-
SHA256
49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706ac
-
SHA512
554c1304361bf8d669dd02462bf5b70e65659d04a2a56683fb9991436f8988d349d558e6b99853ed892b84a71597063d37423201d0ff2f08a58a2a5c6513c011
-
SSDEEP
768:bDcpEBlLfQcubgEp1Ayk96XyXXPdtldE9aHNWnnnl000e999vddddIyyyOwkkkkT:bDcWLfIbgEp10gyX/dtnTHNWnnn6Y
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exedescription ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation 49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe -
Executes dropped EXE 1 IoCs
Processes:
uauhost.exepid Process 3104 uauhost.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Drops file in Windows directory 3 IoCs
Processes:
49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exeattrib.exedescription ioc Process File created C:\Windows\Debug\uauhost.exe 49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe File opened for modification C:\Windows\Debug\uauhost.exe 49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe File opened for modification C:\Windows\Debug\uauhost.exe attrib.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exeuauhost.exeattrib.execmd.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language uauhost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
uauhost.exedescription ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 uauhost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz uauhost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exedescription pid Process Token: SeIncBasePriorityPrivilege 5024 49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exedescription pid Process procid_target PID 5024 wrote to memory of 4196 5024 49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe 83 PID 5024 wrote to memory of 4196 5024 49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe 83 PID 5024 wrote to memory of 4196 5024 49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe 83 PID 5024 wrote to memory of 3184 5024 49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe 89 PID 5024 wrote to memory of 3184 5024 49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe 89 PID 5024 wrote to memory of 3184 5024 49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe 89 -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe"C:\Users\Admin\AppData\Local\Temp\49cc4a9b9c6a3ffab8832a6f41b8a1ccc6025d7cc1e948025c9e24eb921706acN.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5024 -
C:\Windows\SysWOW64\attrib.exeattrib +a +s +h +r C:\Windows\Debug\uauhost.exe2⤵
- Sets file to hidden
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:4196
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\49CC4A~1.EXE > nul2⤵
- System Location Discovery: System Language Discovery
PID:3184
-
-
C:\Windows\Debug\uauhost.exeC:\Windows\Debug\uauhost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Checks processor information in registry
PID:3104
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
75KB
MD50a93787ebee0280558229e1b5126b2a9
SHA1d67af1d9f17847c48b0db22d0bc8a635df06da90
SHA25691c741f03a408366dc0b19e8582a93299ef40c99881f356796f5f90ad204f779
SHA5122223138e4134715239be1b3243a88c62584978f81615d453af6b40df2805ee9d215a83867ac7c4d9d58f4d88aab68e393767365e47a26979f8896221f35c54f9