99b74e18133910a21f58428c8fd9615a8dcb6a496bcda6acd20b5621d7951e43

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
09-12-2024 16:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9HLED_file.exe
Size

3.6MB
MD5

34aad6fec4fa9e1387d268bb6f24f758
SHA1

959cca79e07e7a9589f05ac46d1bf9563d38de8b
SHA256

99b74e18133910a21f58428c8fd9615a8dcb6a496bcda6acd20b5621d7951e43
SHA512

85caddccbef84b9cbd6ad7cc100e3183a72ff99cb4485e7426d06f38aed9e163d5e3c072b5d33b6adf44070955e8a71d1843c5bdb3a1bd3fd136b56ecc42c9ea
SSDEEP

49152:TBwDUAR6Qzk7UHlj796h+16eUMTycWaX/Ngvv1VlHIPIV/CdQvJuJ44wPcbErkcT:TKQtQzv9XUMmczWvnlo0KSj5L1Ln9

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2992	powershell.exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	9HLED_file.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2836	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2112	9HLED_file.exe
2112	9HLED_file.exe
2112	9HLED_file.exe
2112	9HLED_file.exe
2112	9HLED_file.exe
2112	9HLED_file.exe
2112	9HLED_file.exe
2112	9HLED_file.exe
2112	9HLED_file.exe
2112	9HLED_file.exe
2992	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2112	9HLED_file.exe
Token: SeDebugPrivilege	2992	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2112 wrote to memory of 2992	2112	9HLED_file.exe	31
PID 2112 wrote to memory of 2992	2112	9HLED_file.exe	31
PID 2112 wrote to memory of 2992	2112	9HLED_file.exe	31
PID 2112 wrote to memory of 2992	2112	9HLED_file.exe	31
PID 2112 wrote to memory of 2836	2112	9HLED_file.exe	33
PID 2112 wrote to memory of 2836	2112	9HLED_file.exe	33
PID 2112 wrote to memory of 2836	2112	9HLED_file.exe	33
PID 2112 wrote to memory of 2836	2112	9HLED_file.exe	33
PID 2112 wrote to memory of 2548	2112	9HLED_file.exe	35
PID 2112 wrote to memory of 2548	2112	9HLED_file.exe	35
PID 2112 wrote to memory of 2548	2112	9HLED_file.exe	35
PID 2112 wrote to memory of 2548	2112	9HLED_file.exe	35
PID 2112 wrote to memory of 2596	2112	9HLED_file.exe	36
PID 2112 wrote to memory of 2596	2112	9HLED_file.exe	36
PID 2112 wrote to memory of 2596	2112	9HLED_file.exe	36
PID 2112 wrote to memory of 2596	2112	9HLED_file.exe	36
PID 2112 wrote to memory of 2608	2112	9HLED_file.exe	37
PID 2112 wrote to memory of 2608	2112	9HLED_file.exe	37
PID 2112 wrote to memory of 2608	2112	9HLED_file.exe	37
PID 2112 wrote to memory of 2608	2112	9HLED_file.exe	37
PID 2112 wrote to memory of 3040	2112	9HLED_file.exe	38
PID 2112 wrote to memory of 3040	2112	9HLED_file.exe	38
PID 2112 wrote to memory of 3040	2112	9HLED_file.exe	38
PID 2112 wrote to memory of 3040	2112	9HLED_file.exe	38
PID 2112 wrote to memory of 3012	2112	9HLED_file.exe	39
PID 2112 wrote to memory of 3012	2112	9HLED_file.exe	39
PID 2112 wrote to memory of 3012	2112	9HLED_file.exe	39
PID 2112 wrote to memory of 3012	2112	9HLED_file.exe	39

C:\Users\Admin\AppData\Local\Temp\9HLED_file.exe
"C:\Users\Admin\AppData\Local\Temp\9HLED_file.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2112
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\FVhIjYtGTAjNkN.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2992
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\FVhIjYtGTAjNkN" /XML "C:\Users\Admin\AppData\Local\Temp\tmp276E.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2836
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2548
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2596
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:2608
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3040
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
  2⤵
  PID:3012

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp276E.tmp

Filesize
1KB

MD5
153511f546d47ad2dafa4f5b6290eeae

SHA1
1d78b95e1c48fd172c701ddb18a90f03e292cf8a

SHA256
b0a838b5f1c9bcdb4bb993a51f116dc501d881d7f3c6dc47bfa40b303cabb40c

SHA512
c6003858a6033c6f0ac00de06cef825db7ba34bb21ef10ece01c4ce91b49ba91bd7d20400b5c0387d4a0d5f4d6fdb0d6aeea4df49ea10d170bd5de3339a3d884

Download Submit
memory/2112-0-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

Filesize
4KB

Download
memory/2112-1-0x00000000008E0000-0x00000000009D6000-memory.dmp

Filesize
984KB

Download
memory/2112-2-0x0000000074D30000-0x000000007541E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-3-0x00000000003B0000-0x00000000003CE000-memory.dmp

Filesize
120KB

Download
memory/2112-4-0x0000000074D3E000-0x0000000074D3F000-memory.dmp

Filesize
4KB

Download
memory/2112-5-0x0000000074D30000-0x000000007541E000-memory.dmp

Filesize
6.9MB

Download
memory/2112-6-0x0000000005D60000-0x0000000005DCC000-memory.dmp

Filesize
432KB

Download
memory/2112-14-0x0000000074D30000-0x000000007541E000-memory.dmp

Filesize
6.9MB

Download