Analysis
-
max time kernel
98s -
max time network
99s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2024 12:04
Behavioral task
behavioral1
Sample
421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe
Resource
win7-20241010-en
windows7-x64
12 signatures
120 seconds
Behavioral task
behavioral2
Sample
421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
13 signatures
120 seconds
General
-
Target
421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe
-
Size
156KB
-
MD5
12ee1481a91f84a0bc71b45aa00844b0
-
SHA1
309d2273d6875c14acb8976c429e022d9ed5a6ee
-
SHA256
421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6b
-
SHA512
e3293bc77e8177f7abc3a8b51ce05c20941735f9f3c9902201c8f7907529a25d3e1654704b7163324a6ed3b8604e6002ddcc7aa79ef2a8ec609ea548d160075a
-
SSDEEP
3072:+DDDDDDDDDDDDDDDDDDDE45d/t6sVkgZqltP3368JmSLTFh1zgH3/W:I5d/zugZqll30SD1gH3
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2878641211-696417878-3864914810-1000\Control Panel\International\Geo\Nation C68C.tmp -
Deletes itself 1 IoCs
pid Process 3504 C68C.tmp -
Executes dropped EXE 1 IoCs
pid Process 3504 C68C.tmp -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File opened for modification C:\$Recycle.Bin\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe File opened for modification F:\$RECYCLE.BIN\S-1-5-21-2878641211-696417878-3864914810-1000\desktop.ini 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe -
Indicator Removal: File Deletion 1 TTPs
Adversaries may delete files left behind by the actions of their intrusion activity.
-
Suspicious use of NtSetInformationThreadHideFromDebugger 12 IoCs
pid Process 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language C68C.tmp Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
pid Process 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe -
Suspicious behavior: RenamesItself 26 IoCs
pid Process 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp 3504 C68C.tmp -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeAssignPrimaryTokenPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeDebugPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: 36 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeImpersonatePrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeIncBasePriorityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeIncreaseQuotaPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: 33 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeManageVolumePrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeProfSingleProcessPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeRestorePrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSystemProfilePrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeTakeOwnershipPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeShutdownPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeDebugPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 3052 vssvc.exe Token: SeRestorePrivilege 3052 vssvc.exe Token: SeAuditPrivilege 3052 vssvc.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeSecurityPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe Token: SeBackupPrivilege 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 4596 wrote to memory of 3504 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 87 PID 4596 wrote to memory of 3504 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 87 PID 4596 wrote to memory of 3504 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 87 PID 4596 wrote to memory of 3504 4596 421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe 87 PID 3504 wrote to memory of 3656 3504 C68C.tmp 100 PID 3504 wrote to memory of 3656 3504 C68C.tmp 100 PID 3504 wrote to memory of 3656 3504 C68C.tmp 100 -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe"C:\Users\Admin\AppData\Local\Temp\421f922658b985855a580ad3d6736c55817d252a9d6104c944786f7aae393b6bN.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4596 -
C:\ProgramData\C68C.tmp"C:\ProgramData\C68C.tmp"2⤵
- Checks computer location settings
- Deletes itself
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- System Location Discovery: System Language Discovery
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3504 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C DEL /F /Q C:\PROGRA~3\C68C.tmp >> NUL3⤵
- System Location Discovery: System Language Discovery
PID:3656
-
-
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3052
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
129B
MD503a34e8e9fd1b76d6e3118aee48eba98
SHA1994e95b22d0910a3e538f990d32044020c432f68
SHA2561ebf63c5ab7f1e0c5d1575576f9bf9875ca26c981c6f23f0dfd738179dbe1b1f
SHA512134b7e0b0abb4ba963dd2ab89ad437f1384e5a34bf2c29f2dd133a31cc3f6605b31e23a5bb9fba1708fc20b075463dd0f8372b031742550001862cc2581303fd
-
Filesize
14KB
MD5294e9f64cb1642dd89229fff0592856b
SHA197b148c27f3da29ba7b18d6aee8a0db9102f47c9
SHA256917e115cc403e29b4388e0d175cbfac3e7e40ca1742299fbdb353847db2de7c2
SHA512b87d531890bf1577b9b4af41dddb2cdbbfa164cf197bd5987df3a3075983645a3acba443e289b7bfd338422978a104f55298fbfe346872de0895bde44adc89cf
-
C:\Users\Admin\AppData\Local\Temp\DDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDDD
Filesize156KB
MD57eeab9d75d2a7cd66b2e5a610f03c55d
SHA1b39a31237b094bb5001b1ba2ec8a96486f9a1eb4
SHA2569114b432e328d2d51bb6df4957fcc7cbad035b1b5e99fc6b92d4d0978aaaa598
SHA5129252e9e7eda6936c65976a39c217dd7f3eae80fca67ebb36719f3ee9404bac2ba3786198f495e88ad332e04a5c997c7acb42c951d6db352183674b27f830cc29
-
Filesize
129B
MD55df0a1a14e0ec70cdb010d080ca69077
SHA1c6e9c094871e43fb024c504cc59d7d80eb66077e
SHA256413669ad28875750f80f63f2d80b262d5fd28253ac5e87a7af9c35f6ef318d4d
SHA512b0e37e8aa35236f8246072c0c9c3d79443e954210a021cdf8ca991da1fabeaf6d9f15daa3d209692ff55cf3dc1f718247f21710af602dd67c9eb627631ed3916