12ca4ad8cd613c8d086cd39a5c6e787c12209f2271ba850817b72eae3cd559da

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
30/11/2024, 21:21

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

InstalIеr-x86/TTDesktop18.exe
Size

26.0MB
MD5

13eb2bb3303156d695ecf3f2b2c09eb7
SHA1

db1f2877681d02201c6c9d71d8c52a872c3612b9
SHA256

8680e9ff0246c2b7cd4a45a9c6262851ce8d12e4638e48cb1baec267c2b6ea6b
SHA512

6f44a7f1612f0eb4843c1e0de757a03f53d2b14e7aa8b7f983c2ca9baf0701d30f129edeab9c889655840782a1289fb4d0bf0699223e3c584afdaa4ee5172172
SSDEEP

192:0qgaiJUFTQcHVPtAXjJ9vT2O3yP8B50LOZdBcmCEJXVWwTnkVOvQu:57zFEcH769vT2OCkB50LknnVTnkVUQ

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 6 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2752	powershell.exe
1008	powershell.exe
3044	powershell.exe
3008	powershell.exe
2136	powershell.exe
1596	powershell.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	TTDesktop18.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe

Suspicious behavior: EnumeratesProcesses 6 IoCs

pid	Process
2752	powershell.exe
1008	powershell.exe
3044	powershell.exe
3008	powershell.exe
2136	powershell.exe
1596	powershell.exe

Suspicious use of AdjustPrivilegeToken 7 IoCs

description	pid	Process
Token: SeDebugPrivilege	2752	powershell.exe
Token: SeDebugPrivilege	1008	powershell.exe
Token: SeDebugPrivilege	3044	powershell.exe
Token: SeDebugPrivilege	3008	powershell.exe
Token: SeDebugPrivilege	2136	powershell.exe
Token: SeDebugPrivilege	1596	powershell.exe
Token: SeDebugPrivilege	3060	TTDesktop18.exe

Suspicious use of WriteProcessMemory 24 IoCs

description	pid	Process	procid_target
PID 3060 wrote to memory of 2752	3060	TTDesktop18.exe	31
PID 3060 wrote to memory of 2752	3060	TTDesktop18.exe	31
PID 3060 wrote to memory of 2752	3060	TTDesktop18.exe	31
PID 3060 wrote to memory of 2752	3060	TTDesktop18.exe	31
PID 2752 wrote to memory of 1008	2752	powershell.exe	33
PID 2752 wrote to memory of 1008	2752	powershell.exe	33
PID 2752 wrote to memory of 1008	2752	powershell.exe	33
PID 2752 wrote to memory of 1008	2752	powershell.exe	33
PID 3060 wrote to memory of 3044	3060	TTDesktop18.exe	34
PID 3060 wrote to memory of 3044	3060	TTDesktop18.exe	34
PID 3060 wrote to memory of 3044	3060	TTDesktop18.exe	34
PID 3060 wrote to memory of 3044	3060	TTDesktop18.exe	34
PID 3044 wrote to memory of 3008	3044	powershell.exe	36
PID 3044 wrote to memory of 3008	3044	powershell.exe	36
PID 3044 wrote to memory of 3008	3044	powershell.exe	36
PID 3044 wrote to memory of 3008	3044	powershell.exe	36
PID 3060 wrote to memory of 2136	3060	TTDesktop18.exe	37
PID 3060 wrote to memory of 2136	3060	TTDesktop18.exe	37
PID 3060 wrote to memory of 2136	3060	TTDesktop18.exe	37
PID 3060 wrote to memory of 2136	3060	TTDesktop18.exe	37
PID 2136 wrote to memory of 1596	2136	powershell.exe	39
PID 2136 wrote to memory of 1596	2136	powershell.exe	39
PID 2136 wrote to memory of 1596	2136	powershell.exe	39
PID 2136 wrote to memory of 1596	2136	powershell.exe	39

C:\Users\Admin\AppData\Local\Temp\InstalIеr-x86\TTDesktop18.exe
"C:\Users\Admin\AppData\Local\Temp\InstalIеr-x86\TTDesktop18.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3060
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\OFCLbCSL'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2752
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\OFCLbCSL
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Users'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3044
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Users
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:3008
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell.exe" powershell -Command "Add-MpPreference -ExclusionPath 'C:\Windows'"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2136
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -Command Add-MpPreference -ExclusionPath C:\Windows
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - System Location Discovery: System Language Discovery
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1596

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
c5917224d180ff88af8a2251e10a6338

SHA1
80ab0cdfc252bb66189fb9937168bac8acbdee72

SHA256
241052b4d68eeda4ef72a7e24392794370d019d8fb3ca1a40e4ca99fa7da2a4c

SHA512
0eeab11b84fb67791d1b015374e89ede9395ae4780170ce567d78a228f6af0f0b5a007fb676ea466ea1d89b2acc7d63e6814fea179ac713c465ea0b6b2632eb5

Download Submit
memory/2752-4-0x0000000071261000-0x0000000071262000-memory.dmp

Filesize
4KB

Download
memory/2752-5-0x0000000071260000-0x000000007180B000-memory.dmp

Filesize
5.7MB

Download
memory/2752-6-0x0000000071260000-0x000000007180B000-memory.dmp

Filesize
5.7MB

Download
memory/2752-8-0x0000000071260000-0x000000007180B000-memory.dmp

Filesize
5.7MB

Download
memory/2752-7-0x0000000071260000-0x000000007180B000-memory.dmp

Filesize
5.7MB

Download
memory/2752-14-0x0000000071260000-0x000000007180B000-memory.dmp

Filesize
5.7MB

Download
memory/3060-0-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

Filesize
4KB

Download
memory/3060-1-0x0000000000BA0000-0x0000000000BAA000-memory.dmp

Filesize
40KB

Download
memory/3060-36-0x0000000074A8E000-0x0000000074A8F000-memory.dmp

Filesize
4KB

Download
memory/3060-37-0x0000000000B40000-0x0000000000B80000-memory.dmp

Filesize
256KB

Download