733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30-11-2024 00:31

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
Size

1.1MB
MD5

a57b7e38d1765b7f08587a7d9004894b
SHA1

d4e8d9a1de6621b4ec9a8c4fba962b7f7b53221f
SHA256

733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a
SHA512

54aeec3eba54e56c26ed31107e65cda1b594b6d054823e6f10a3f1509c3943b2fad8dc4cc3cffa0df731bd312eeb1e43589b0d610dcdda628be19599a6e52f82
SSDEEP

24576:6qvk/2pbAX+MRzZeIeKK2gOSAt4hI+KXb:zvkO5AFzAN0hSAt4oXb

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2760	powershell.exe
2876	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2856	schtasks.exe

Suspicious behavior: EnumeratesProcesses 14 IoCs

pid	Process
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
2760	powershell.exe
2876	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
Token: SeDebugPrivilege	2760	powershell.exe
Token: SeDebugPrivilege	2876	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

description	pid	Process	procid_target
PID 2396 wrote to memory of 2760	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	31
PID 2396 wrote to memory of 2760	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	31
PID 2396 wrote to memory of 2760	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	31
PID 2396 wrote to memory of 2760	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	31
PID 2396 wrote to memory of 2876	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	33
PID 2396 wrote to memory of 2876	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	33
PID 2396 wrote to memory of 2876	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	33
PID 2396 wrote to memory of 2876	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	33
PID 2396 wrote to memory of 2856	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	34
PID 2396 wrote to memory of 2856	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	34
PID 2396 wrote to memory of 2856	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	34
PID 2396 wrote to memory of 2856	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	34
PID 2396 wrote to memory of 2784	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	37
PID 2396 wrote to memory of 2784	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	37
PID 2396 wrote to memory of 2784	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	37
PID 2396 wrote to memory of 2784	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	37
PID 2396 wrote to memory of 2668	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	38
PID 2396 wrote to memory of 2668	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	38
PID 2396 wrote to memory of 2668	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	38
PID 2396 wrote to memory of 2668	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	38
PID 2396 wrote to memory of 1656	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	39
PID 2396 wrote to memory of 1656	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	39
PID 2396 wrote to memory of 1656	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	39
PID 2396 wrote to memory of 1656	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	39
PID 2396 wrote to memory of 2612	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	40
PID 2396 wrote to memory of 2612	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	40
PID 2396 wrote to memory of 2612	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	40
PID 2396 wrote to memory of 2612	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	40
PID 2396 wrote to memory of 2608	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	41
PID 2396 wrote to memory of 2608	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	41
PID 2396 wrote to memory of 2608	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	41
PID 2396 wrote to memory of 2608	2396	733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe	41

C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
"C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2396
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2760
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\DeyPhKdN.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2876
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\DeyPhKdN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF96C.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2856
- C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
  "C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe"
  2⤵
  PID:2784
- C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
  "C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe"
  2⤵
  PID:2668
- C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
  "C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe"
  2⤵
  PID:1656
- C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
  "C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe"
  2⤵
  PID:2612
- C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe
  "C:\Users\Admin\AppData\Local\Temp\733e47fd70fea7d93b7093c5e859c0abb2e54f338c4f256791847dc3b1a5349a.exe"
  2⤵
  PID:2608

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmpF96C.tmp

Filesize
1KB

MD5
d28c6dd2896b22b8b4d076ff79c0bd66

SHA1
536d466d1b7aafe4a545da0d14a57e4c5dd39958

SHA256
3b80bf1caa72390a2ea542a81a3e6722ce90f654d16ad031671efc73ce9c2fbf

SHA512
7b3220592ce671d190ed92a62d956db5c982214ae46bbb1733508d53306fe804c677de7c8fa8ed993c7af7ee8e3b39dbea6bbfb8dd261482b0fede3c2ddde0f1

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\HX26OXSJV8ARKTFJ3ZRN.temp

Filesize
7KB

MD5
2f84ecca286b1f7a4eb6fc16271ebb3d

SHA1
45fe421966a04f2ec7bbae0be529b1b2b4ae8f05

SHA256
e72b27e84c559b1874ffa40c88635da69fc9b334fce2ae2c128fb8cc44c3cf31

SHA512
76734377e454903c45405115cd00243677a19fa4823f9dd2bb145d0f5cb8a428137aafd30848c8c2a29128e46e8d05a40b90bebb843a550f61daa4d85f2725fe

Download Submit
memory/2396-0-0x000000007463E000-0x000000007463F000-memory.dmp

Filesize
4KB

Download
memory/2396-1-0x0000000000360000-0x000000000047C000-memory.dmp

Filesize
1.1MB

Download
memory/2396-2-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2396-3-0x0000000000570000-0x000000000058C000-memory.dmp

Filesize
112KB

Download
memory/2396-4-0x000000007463E000-0x000000007463F000-memory.dmp

Filesize
4KB

Download
memory/2396-5-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download
memory/2396-6-0x0000000005DC0000-0x0000000005E84000-memory.dmp

Filesize
784KB

Download
memory/2396-19-0x0000000074630000-0x0000000074D1E000-memory.dmp

Filesize
6.9MB

Download