Analysis
-
max time kernel
119s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 03:24
Static task
static1
Behavioral task
behavioral1
Sample
d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe
Resource
win10v2004-20241007-en
General
-
Target
d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe
-
Size
781KB
-
MD5
77b41bd5ad40ca65a9b807ad7f56578c
-
SHA1
bb0a8b1013ce05aa8a8fc3881bcb2a31e3ecc2bb
-
SHA256
d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049
-
SHA512
323321ee89f2671455cd7bfe85dc6198032293f70b1649562f7fb6f165715a1fdb5a351d7b0b9195f50cc113191dff7a00847b11fbcc27cf59bd510266da9e45
-
SSDEEP
24576:dTgIeeHprA7IEylv5iawyIXPABCdWeSi4daI:WBeJryynOyFcWHvda
Malware Config
Signatures
-
Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 2804 powershell.exe 2808 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2736 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
pid Process 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 2808 powershell.exe 2804 powershell.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe Token: SeDebugPrivilege 2804 powershell.exe Token: SeDebugPrivilege 2808 powershell.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2696 wrote to memory of 2804 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 31 PID 2696 wrote to memory of 2804 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 31 PID 2696 wrote to memory of 2804 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 31 PID 2696 wrote to memory of 2804 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 31 PID 2696 wrote to memory of 2808 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 33 PID 2696 wrote to memory of 2808 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 33 PID 2696 wrote to memory of 2808 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 33 PID 2696 wrote to memory of 2808 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 33 PID 2696 wrote to memory of 2736 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 34 PID 2696 wrote to memory of 2736 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 34 PID 2696 wrote to memory of 2736 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 34 PID 2696 wrote to memory of 2736 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 34 PID 2696 wrote to memory of 2892 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 37 PID 2696 wrote to memory of 2892 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 37 PID 2696 wrote to memory of 2892 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 37 PID 2696 wrote to memory of 2892 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 37 PID 2696 wrote to memory of 2612 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 38 PID 2696 wrote to memory of 2612 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 38 PID 2696 wrote to memory of 2612 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 38 PID 2696 wrote to memory of 2612 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 38 PID 2696 wrote to memory of 2608 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 39 PID 2696 wrote to memory of 2608 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 39 PID 2696 wrote to memory of 2608 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 39 PID 2696 wrote to memory of 2608 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 39 PID 2696 wrote to memory of 2628 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 40 PID 2696 wrote to memory of 2628 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 40 PID 2696 wrote to memory of 2628 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 40 PID 2696 wrote to memory of 2628 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 40 PID 2696 wrote to memory of 2644 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 41 PID 2696 wrote to memory of 2644 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 41 PID 2696 wrote to memory of 2644 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 41 PID 2696 wrote to memory of 2644 2696 d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2696 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2804
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\AZuPqFXfyrxB.exe"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2808
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\AZuPqFXfyrxB" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD98D.tmp"2⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2736
-
-
C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"2⤵PID:2892
-
-
C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"2⤵PID:2612
-
-
C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"2⤵PID:2608
-
-
C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"2⤵PID:2628
-
-
C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"C:\Users\Admin\AppData\Local\Temp\d2e02002409982274c26172e7360d2c5114b70035fff2f3d6ba263dc110f3049.exe"2⤵PID:2644
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD503fa191187146a0fe8192ac50c96cafd
SHA127380189c76be95c86e44f7aafbf5c6efe9e702f
SHA256f517fcfd285a0096c0024e7e0676a45b10cdc5aeb4897d0207bb160b689cb861
SHA5127dd42608fbecc93281b33976ba86d76e7e2f7d3f5dfe15bf1590a4ce97adc49e6184f64cbdb289c14cf19ab031c9734fb0b55f3da882a00fbf89afcf8f644de8
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\EDLSWBKD8VITEAYQP34Y.temp
Filesize7KB
MD597cefe8c6ae235906a9be6e8d66d9b69
SHA1fea7209f68dacea55a09175013dc8f9c22a94394
SHA256c90ae340e3c1d22c63508b52f7c6c249f755842fcb0dd2eed61122e2fc44793f
SHA5126f6a3baa481fa224e55f7db3d23f5c573ced31b730ad71a77a0e91910e27d64eac734a85ecf60ad37c6eca911e64a577c78848f2b90c8dc18916b4843b718e28