a654c852e1dc441eb077e2b07815e5114d798c210b9025371d6a9b7fbfc1b7d8

General

Target

Inquiry 241128.exe
Size

896KB
MD5

bab35b6fe111a241883bdbd3f9996a30
SHA1

9901d14b05a9e8305a4660ead1a334571f7017fe
SHA256

2c67cd53627199ab4741a3fe73a317b1f91fd46544e06ed251b8ab8b444170a8
SHA512

d2be9b3dc1472cb8ca4cd110f09cd3e305ffa3dafa2725fd41eec601505a0ffabc68322f9a28d6548d8bfe9ce14a9cdc9e9a6f038fa7856cf7b32b9301aa77bb
SSDEEP

24576:k2xj0BZodxnaB89JG0Z7dFXue45xMP9LCnYnL:H+BZ0hBG0Z7+eOOPAnY

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2860	powershell.exe
2760	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

Processes:

Inquiry 241128.exe

description	pid	Process	procid_target
PID 3036 set thread context of 2648	3036	Inquiry 241128.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

Inquiry 241128.exepowershell.exepowershell.exeschtasks.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Inquiry 241128.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
2744	schtasks.exe

Suspicious behavior: EnumeratesProcesses 9 IoCs

Processes:

powershell.exepowershell.exeInquiry 241128.exe

pid	Process
2860	powershell.exe
2760	powershell.exe
2648	Inquiry 241128.exe
2648	Inquiry 241128.exe
2648	Inquiry 241128.exe
2648	Inquiry 241128.exe
2648	Inquiry 241128.exe
2648	Inquiry 241128.exe
2648	Inquiry 241128.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes:

powershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2860	powershell.exe
Token: SeDebugPrivilege	2760	powershell.exe

Suspicious use of WriteProcessMemory 19 IoCs

Processes:

Inquiry 241128.exe

description	pid	Process	procid_target
PID 3036 wrote to memory of 2860	3036	Inquiry 241128.exe	31
PID 3036 wrote to memory of 2860	3036	Inquiry 241128.exe	31
PID 3036 wrote to memory of 2860	3036	Inquiry 241128.exe	31
PID 3036 wrote to memory of 2860	3036	Inquiry 241128.exe	31
PID 3036 wrote to memory of 2760	3036	Inquiry 241128.exe	33
PID 3036 wrote to memory of 2760	3036	Inquiry 241128.exe	33
PID 3036 wrote to memory of 2760	3036	Inquiry 241128.exe	33
PID 3036 wrote to memory of 2760	3036	Inquiry 241128.exe	33
PID 3036 wrote to memory of 2744	3036	Inquiry 241128.exe	35
PID 3036 wrote to memory of 2744	3036	Inquiry 241128.exe	35
PID 3036 wrote to memory of 2744	3036	Inquiry 241128.exe	35
PID 3036 wrote to memory of 2744	3036	Inquiry 241128.exe	35
PID 3036 wrote to memory of 2648	3036	Inquiry 241128.exe	37
PID 3036 wrote to memory of 2648	3036	Inquiry 241128.exe	37
PID 3036 wrote to memory of 2648	3036	Inquiry 241128.exe	37
PID 3036 wrote to memory of 2648	3036	Inquiry 241128.exe	37
PID 3036 wrote to memory of 2648	3036	Inquiry 241128.exe	37
PID 3036 wrote to memory of 2648	3036	Inquiry 241128.exe	37
PID 3036 wrote to memory of 2648	3036	Inquiry 241128.exe	37

C:\Users\Admin\AppData\Local\Temp\Inquiry 241128.exe
"C:\Users\Admin\AppData\Local\Temp\Inquiry 241128.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3036
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\Inquiry 241128.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2860
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\oklxWiuHrvEbN.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\oklxWiuHrvEbN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp11EB.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2744
- C:\Users\Admin\AppData\Local\Temp\Inquiry 241128.exe
  "C:\Users\Admin\AppData\Local\Temp\Inquiry 241128.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

PowerShell

1

T1059.001

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Persistence

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Privilege Escalation

Scheduled Task/Job

1

T1053

Scheduled Task

1

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

System Location Discovery

1

T1614

System Language Discovery

1

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp11EB.tmp

Filesize
1KB

MD5
9d1b122fcdcb6d97e2556bfb83310a9c

SHA1
f5b206ba8ebfd4e4150ef738cd577a8bbf2e124e

SHA256
30b5c423c050dff1025150b05cfb5d9a70c08ce9f92f20eeb98ab6d5afa3ea0c

SHA512
412364dedf264e184cfcfa72bf62d8e4e9b6c6d3752fe62cba97189e121f557d960a396d0d15543be2f684106443c584dab95b74a1ce5ab63d9155c8e2836935

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
330b0555be39cb008d8e27f487af0afb

SHA1
07d442463bdf5a1bb84107cd9ba89b078d211b82

SHA256
8ae071a0c32ecf17f70e9fbea46add4ee1154adf720f1abc24bc86128f458029

SHA512
87c5e2a4d8e38b19562075708006637a4847113e10244ae25463edb78bf9a8d6c46827a321ba8cbf4ee4341b76bfdfe56a5df0f0800e57c0752ce0003c9fa334

Download Submit
memory/2648-21-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2648-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2648-24-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/2648-20-0x0000000000400000-0x0000000000447000-memory.dmp

Filesize
284KB

Download
memory/3036-3-0x0000000000440000-0x0000000000458000-memory.dmp

Filesize
96KB

Download
memory/3036-6-0x0000000000ED0000-0x0000000000F62000-memory.dmp

Filesize
584KB

Download
memory/3036-5-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-4-0x00000000742AE000-0x00000000742AF000-memory.dmp

Filesize
4KB

Download
memory/3036-0-0x00000000742AE000-0x00000000742AF000-memory.dmp

Filesize
4KB

Download
memory/3036-2-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download
memory/3036-1-0x0000000001310000-0x00000000013F6000-memory.dmp

Filesize
920KB

Download
memory/3036-25-0x00000000742A0000-0x000000007498E000-memory.dmp

Filesize
6.9MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads