5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6

Analysis

max time kernel
122s
max time network
123s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
03-12-2024 10:02

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
Size

3.7MB
MD5

cd765738ca380479232b3742bec4681a
SHA1

72183452d01eabefa4a1dc4e4702df04aca6da4e
SHA256

5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6
SHA512

047266f5d2f30661857c501c705a18128082551498351eee28600bfb051e276535e00abfa0dd30acbcdb01e9238958f06ca934abb094ee03666cae51475ed6f5
SSDEEP

49152:sBe/wR+kPCndafDZ7MTpxKQ4vWcucxZIp6/Y6HhxVetUw5WxGea2rkoVAAVsK5Iw:/namVxrcxys/XhxsuwEUeFzyRM

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

Processes:

powershell.exepowershell.exe

pid	Process
2784	powershell.exe
2980	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

Processes:

5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exepowershell.exepowershell.exeschtasks.exe

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

Processes:

schtasks.exe

pid	Process
3052	schtasks.exe

Suspicious behavior: EnumeratesProcesses 12 IoCs

Processes:

5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exepowershell.exepowershell.exe

pid	Process
2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
2980	powershell.exe
2784	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

Processes:

5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exepowershell.exepowershell.exe

description	pid	Process
Token: SeDebugPrivilege	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
Token: SeDebugPrivilege	2980	powershell.exe
Token: SeDebugPrivilege	2784	powershell.exe

Suspicious use of WriteProcessMemory 32 IoCs

Processes:

5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe

description	pid	Process	procid_target
PID 2648 wrote to memory of 2784	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	30
PID 2648 wrote to memory of 2784	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	30
PID 2648 wrote to memory of 2784	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	30
PID 2648 wrote to memory of 2784	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	30
PID 2648 wrote to memory of 2980	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	32
PID 2648 wrote to memory of 2980	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	32
PID 2648 wrote to memory of 2980	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	32
PID 2648 wrote to memory of 2980	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	32
PID 2648 wrote to memory of 3052	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	33
PID 2648 wrote to memory of 3052	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	33
PID 2648 wrote to memory of 3052	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	33
PID 2648 wrote to memory of 3052	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	33
PID 2648 wrote to memory of 2196	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	36
PID 2648 wrote to memory of 2196	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	36
PID 2648 wrote to memory of 2196	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	36
PID 2648 wrote to memory of 2196	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	36
PID 2648 wrote to memory of 2212	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	37
PID 2648 wrote to memory of 2212	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	37
PID 2648 wrote to memory of 2212	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	37
PID 2648 wrote to memory of 2212	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	37
PID 2648 wrote to memory of 2148	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	38
PID 2648 wrote to memory of 2148	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	38
PID 2648 wrote to memory of 2148	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	38
PID 2648 wrote to memory of 2148	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	38
PID 2648 wrote to memory of 1488	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	39
PID 2648 wrote to memory of 1488	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	39
PID 2648 wrote to memory of 1488	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	39
PID 2648 wrote to memory of 1488	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	39
PID 2648 wrote to memory of 2540	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	40
PID 2648 wrote to memory of 2540	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	40
PID 2648 wrote to memory of 2540	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	40
PID 2648 wrote to memory of 2540	2648	5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe	40

C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
"C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2648
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2784
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\IoOrGePEOIrHFn.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2980
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\IoOrGePEOIrHFn" /XML "C:\Users\Admin\AppData\Local\Temp\tmp2EED.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:3052
- C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
  "C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe"
  2⤵
  PID:2196
- C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
  "C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe"
  2⤵
  PID:2212
- C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
  "C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe"
  2⤵
  PID:2148
- C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
  "C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe"
  2⤵
  PID:1488
- C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe
  "C:\Users\Admin\AppData\Local\Temp\5182c93d80ab847541599124d388613c23bfb193b7879f5395b421bba5c568f6.exe"
  2⤵
  PID:2540

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp2EED.tmp

Filesize
1KB

MD5
dab67b7ca1c26687aa44ea6ef7c50d38

SHA1
7d73b19d66852c650d2d80dab606b85e76483922

SHA256
e2e4522c8a0c155124af603fd4f551afb2ed78d9ec6fdb87a72b0d8aa0d7ae68

SHA512
69e8e0964ef230055a19d53a034e980edae82b24823b32679cfaef03d72d582f7ff9d1aaee35cade42d969b6b5d4e26e0f8ae800b7579c8413f533236a392063

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms

Filesize
7KB

MD5
931829e3a61f666e2d5a30fd3e35711c

SHA1
77a222c37d72bf7935b7b7210d8e563eb004499e

SHA256
972716169a3d5371cfb851b0e625ec145783d5242183e4a99da2db0df387c1e9

SHA512
3603b61077c17c3fb93a8137f5a9f9cbd49ab9194680595d8e3944b646c879d01c30f21023ef1cd5ea5a78d93c4d3fadf6acf1842ef0436e7c366972c7c07eea

Download Submit
memory/2648-0-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

Filesize
4KB

Download
memory/2648-1-0x00000000000C0000-0x000000000046C000-memory.dmp

Filesize
3.7MB

Download
memory/2648-2-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-3-0x00000000007A0000-0x00000000007B8000-memory.dmp

Filesize
96KB

Download
memory/2648-4-0x0000000074BEE000-0x0000000074BEF000-memory.dmp

Filesize
4KB

Download
memory/2648-5-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download
memory/2648-6-0x0000000007C30000-0x0000000007F98000-memory.dmp

Filesize
3.4MB

Download
memory/2648-19-0x0000000074BE0000-0x00000000752CE000-memory.dmp

Filesize
6.9MB

Download