Analysis
-
max time kernel
118s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
30-11-2024 12:04
Behavioral task
behavioral1
Sample
421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
120 seconds
Behavioral task
behavioral2
Sample
421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe
-
Size
156KB
-
MD5
12ee1481a91f84a0bc71b45aa00844b0
-
SHA1
309d2273d6875c14acb8976c429e022d9ed5a6ee
-
SHA256
421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6b
-
SHA512
e3293bc77e8177f7abc3a8b51ce05c20941735f9f3c9902201c8f7907529a25d3e1654704b7163324a6ed3b8604e6002ddcc7aa79ef2a8ec609ea548d160075a
-
SSDEEP
3072:+DDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368JmSLTFh1zgH3/W:I5d/zugZqll30SD1gH3
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1564 AD30.tmp -
Executes dropped EXE 1 IoCs
pid Process 1564 AD30.tmp -
Loads dropped DLL 1 IoCs
pid Process 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2039016743-699959520-214465309-1000\desktop.ini 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language AD30.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp 1564 AD30.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeDebugPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: 36 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeImpersonatePrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeIncBasePriorityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeIncreaseQuotaPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: 33 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeManageVolumePrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeProfSingleProcessPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeRestorePrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSystemProfilePrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeTakeOwnershipPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeShutdownPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeDebugPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2728 vssvc.exe Token: SeRestorePrivilege 2728 vssvc.exe Token: SeAuditPrivilege 2728 vssvc.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2920 wrote to memory of 1564 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 33 PID 2920 wrote to memory of 1564 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 33 PID 2920 wrote to memory of 1564 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 33 PID 2920 wrote to memory of 1564 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 33 PID 2920 wrote to memory of 1564 2920 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 33 PID 1564 wrote to memory of 2152 1564 AD30.tmp 37 PID 1564 wrote to memory of 2152 1564 AD30.tmp 37 PID 1564 wrote to memory of 2152 1564 AD30.tmp 37 PID 1564 wrote to memory of 2152 1564 AD30.tmp 37 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe"C:\Users\Admin\AppData\Local\Temp\421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe"1⤵
- Loads dropped DLL
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2920 -
C:\ProgramData\AD30.tmp"C:\ProgramData\AD30.tmp"2⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1564 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\AD30.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:2152
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2728
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x14c1⤵PID:1548
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD55dd4652c4132a7533b758ae4c93d90c8
SHA169e64122b1279f99bdee9dd40267db483dd418ca
SHA25603db76a96495ab5e54cd8db74a42103ff22ac52ac646a00bd68407deadba814e
SHA512729d5364709903643afbb3e79bd2b4a8a33fd3c715b9d4740ef43beaaa56cfb914080e5f6d096762d518b523f2541d7b49939149eccb481a85fd631282ae19d9
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize156KB
MD5fd8aa8ad632919b8873343f610d24339
SHA123380ef3d6147306ae96b3f910b5de7d64deaf4a
SHA256e0f55cb1e8f5630d1bbcec6380f83245aa18b13232d3f63cde5c2241a821536b
SHA5126cbf2e68fbc114842b86ada7b00425991894c4a12310a863e30143e480cc3b8bda9bdd796456cd7d7b1c7c25e7bd127178869ec5eb39055c942f1105d940567f
-
Filesize
129B
MD5196c4afcd528d2ff38a7df4ecfaf759c
SHA1c3c7835d560b8b8d66ffa61e139c1d06be338237
SHA256414e1246f60e8aaf64b131dc87e520d360a3060e5deee5a288046c71a7ca60f6
SHA5122223c36adc67498d1cf878c2ea6ffbb64311db07d0f38728dd7a70e0ac83af7c0d98337a5fedb43085b575c50c035e0f21134fe2212c6611fac0886129d3692a