Analysis
-
max time kernel
134s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
13-12-2024 02:17
Static task
static1
Behavioral task
behavioral1
Sample
33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe
Resource
win7-20240903-en
Behavioral task
behavioral2
Sample
33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe
Resource
win10v2004-20241007-en
General
-
Target
33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe
-
Size
1.1MB
-
MD5
c6556cae0fd8c8c81a57c47f79573a9a
-
SHA1
df15f052ade6d9a85d1a824c82a7235902f057e2
-
SHA256
33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8
-
SHA512
2045a0e0eec4345177b65b348db99b97764599e49036212be0ac481dcc289ee9056cd06bd373285dea592743d9399ebc60a691909eea18cbb9a70ca7c3b3a248
-
SSDEEP
24576:9R36hdkwBjSEyfE75BP/+mgWdm/bTmmLKST:HAzFSOr2mgxvm
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 896 programs.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-940901362-3608833189-1915618603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\programs = "C:\\Users\\Admin\\Music\\programs.exe" reg.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language programs.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 5 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 1176 cmd.exe 840 PING.EXE 2668 cmd.exe 4136 PING.EXE 3008 PING.EXE -
Runs ping.exe 1 TTPs 3 IoCs
pid Process 840 PING.EXE 4136 PING.EXE 3008 PING.EXE -
Suspicious behavior: EnumeratesProcesses 29 IoCs
pid Process 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 896 programs.exe 896 programs.exe 896 programs.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe Token: SeDebugPrivilege 896 programs.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4036 wrote to memory of 1176 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 83 PID 4036 wrote to memory of 1176 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 83 PID 4036 wrote to memory of 1176 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 83 PID 1176 wrote to memory of 840 1176 cmd.exe 85 PID 1176 wrote to memory of 840 1176 cmd.exe 85 PID 1176 wrote to memory of 840 1176 cmd.exe 85 PID 4036 wrote to memory of 2668 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 101 PID 4036 wrote to memory of 2668 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 101 PID 4036 wrote to memory of 2668 4036 33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe 101 PID 2668 wrote to memory of 4136 2668 cmd.exe 103 PID 2668 wrote to memory of 4136 2668 cmd.exe 103 PID 2668 wrote to memory of 4136 2668 cmd.exe 103 PID 1176 wrote to memory of 4424 1176 cmd.exe 105 PID 1176 wrote to memory of 4424 1176 cmd.exe 105 PID 1176 wrote to memory of 4424 1176 cmd.exe 105 PID 2668 wrote to memory of 3008 2668 cmd.exe 107 PID 2668 wrote to memory of 3008 2668 cmd.exe 107 PID 2668 wrote to memory of 3008 2668 cmd.exe 107 PID 2668 wrote to memory of 896 2668 cmd.exe 108 PID 2668 wrote to memory of 896 2668 cmd.exe 108 PID 2668 wrote to memory of 896 2668 cmd.exe 108
Processes
-
C:\Users\Admin\AppData\Local\Temp\33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe"C:\Users\Admin\AppData\Local\Temp\33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4036 -
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 38 > nul && REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "programs" /t REG_SZ /d "C:\Users\Admin\Music\programs.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:1176 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 383⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:840
-
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "programs" /t REG_SZ /d "C:\Users\Admin\Music\programs.exe"3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4424
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd" /c ping 127.0.0.1 -n 47 > nul && copy "C:\Users\Admin\AppData\Local\Temp\33b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8.exe" "C:\Users\Admin\Music\programs.exe" && ping 127.0.0.1 -n 47 > nul && "C:\Users\Admin\Music\programs.exe"2⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2668 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 473⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:4136
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 473⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:3008
-
-
C:\Users\Admin\Music\programs.exe"C:\Users\Admin\Music\programs.exe"3⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:896
-
-
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5c6556cae0fd8c8c81a57c47f79573a9a
SHA1df15f052ade6d9a85d1a824c82a7235902f057e2
SHA25633b8680de84d8f21e81ca596cd8cefc5b019b9060e2c9e1f3d92e296cb40e9e8
SHA5122045a0e0eec4345177b65b348db99b97764599e49036212be0ac481dcc289ee9056cd06bd373285dea592743d9399ebc60a691909eea18cbb9a70ca7c3b3a248