Analysis
-
max time kernel
121s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
04-12-2024 14:30
Static task
static1
Behavioral task
behavioral1
Sample
FRA.2080 GRACARE MAIG (2).exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
FRA.2080 GRACARE MAIG (2).exe
Resource
win10v2004-20241007-en
General
-
Target
FRA.2080 GRACARE MAIG (2).exe
-
Size
528KB
-
MD5
341ae38ffefa01cb1ce586636e6629db
-
SHA1
ec0f4fa6942ef3aadc183d440239e883faeab607
-
SHA256
2ff3d2bda15e7a1ceb97f318d9e85d930e6a75a135d70b953b708c96f90921a7
-
SHA512
8b342bb4b381421be54a5876fba24cc6bccc1a0ecca48c6afb949b97645fdb69141e1dd1017d97fde3a3a080897a79534d0719119d4d2a076573b2c72fb98819
-
SSDEEP
12288:aICiw3Giju9h1LrEOn1UuwE1eu0yoS/B3FYA1Y/:Miw2Uu9DLrEOnZwo/z/lJs
Malware Config
Signatures
-
pid Process 1696 powershell.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FRA.2080 GRACARE MAIG (2).exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language powershell.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1696 powershell.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1696 powershell.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2328 wrote to memory of 1696 2328 FRA.2080 GRACARE MAIG (2).exe 31 PID 2328 wrote to memory of 1696 2328 FRA.2080 GRACARE MAIG (2).exe 31 PID 2328 wrote to memory of 1696 2328 FRA.2080 GRACARE MAIG (2).exe 31 PID 2328 wrote to memory of 1696 2328 FRA.2080 GRACARE MAIG (2).exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\FRA.2080 GRACARE MAIG (2).exe"C:\Users\Admin\AppData\Local\Temp\FRA.2080 GRACARE MAIG (2).exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2328 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" -windowstyle minimized "$Citrona=Get-Content -Raw 'C:\Users\Admin\AppData\Roaming\postarmistice\monospermy\brevbombe\Frierne3.bli';$Acaulose=$Citrona.SubString(43554,3);.$Acaulose($Citrona)"2⤵
- Command and Scripting Interpreter: PowerShell
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1696
-