Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
18-12-2024 10:29
Behavioral task
behavioral1
Sample
56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe
Resource
win7-20241010-en
Behavioral task
behavioral2
Sample
56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe
Resource
win10v2004-20241007-en
General
-
Target
56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe
-
Size
164KB
-
MD5
1ebb888eb774b33e4f91d7dad2c00737
-
SHA1
f272c1a38563aa52d40dad5234ec3a5284768e26
-
SHA256
56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f
-
SHA512
beb867449918c2ace20abf0b92654c6eee5bca74dc4af8053cb31f838775e96350e40c4a6ea7067d24c4f53b5b767d6e343623ef8faa37847165c82a00cff1c6
-
SSDEEP
3072:8w11/wTvYZDDNF90qhRb70L8czxE2YY6q9bLzl6fHMEBuo3:8wZD9b70wczSTYh9bAlD3
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupHelper.exe StartupHelper.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StartupHelper.exe StartupHelper.exe -
Executes dropped EXE 3 IoCs
pid Process 1996 StartupHelper.exe 396 StartupHelper.exe 1980 StartupHelper.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\StartupHelper.exe = "\"C:\\Windows\\StartupHelper.exe\" .." StartupHelper.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\StartupHelper.exe = "\"C:\\Windows\\StartupHelper.exe\" .." StartupHelper.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\StartupHelper.exe 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 12 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language StartupHelper.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 4 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 368 schtasks.exe 1948 schtasks.exe 2576 schtasks.exe 788 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 27 IoCs
description pid Process Token: SeDebugPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe Token: 33 1996 StartupHelper.exe Token: SeIncBasePriorityPrivilege 1996 StartupHelper.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 4408 wrote to memory of 3544 4408 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe 83 PID 4408 wrote to memory of 3544 4408 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe 83 PID 4408 wrote to memory of 3544 4408 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe 83 PID 4408 wrote to memory of 368 4408 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe 85 PID 4408 wrote to memory of 368 4408 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe 85 PID 4408 wrote to memory of 368 4408 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe 85 PID 4408 wrote to memory of 1996 4408 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe 87 PID 4408 wrote to memory of 1996 4408 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe 87 PID 4408 wrote to memory of 1996 4408 56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe 87 PID 1996 wrote to memory of 1544 1996 StartupHelper.exe 88 PID 1996 wrote to memory of 1544 1996 StartupHelper.exe 88 PID 1996 wrote to memory of 1544 1996 StartupHelper.exe 88 PID 1996 wrote to memory of 1948 1996 StartupHelper.exe 90 PID 1996 wrote to memory of 1948 1996 StartupHelper.exe 90 PID 1996 wrote to memory of 1948 1996 StartupHelper.exe 90 PID 396 wrote to memory of 4444 396 StartupHelper.exe 102 PID 396 wrote to memory of 4444 396 StartupHelper.exe 102 PID 396 wrote to memory of 4444 396 StartupHelper.exe 102 PID 396 wrote to memory of 2576 396 StartupHelper.exe 104 PID 396 wrote to memory of 2576 396 StartupHelper.exe 104 PID 396 wrote to memory of 2576 396 StartupHelper.exe 104 PID 1980 wrote to memory of 2928 1980 StartupHelper.exe 107 PID 1980 wrote to memory of 2928 1980 StartupHelper.exe 107 PID 1980 wrote to memory of 2928 1980 StartupHelper.exe 107 PID 1980 wrote to memory of 788 1980 StartupHelper.exe 109 PID 1980 wrote to memory of 788 1980 StartupHelper.exe 109 PID 1980 wrote to memory of 788 1980 StartupHelper.exe 109
Processes
-
C:\Users\Admin\AppData\Local\Temp\56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe"C:\Users\Admin\AppData\Local\Temp\56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4408 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:3544
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\56f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:368
-
-
C:\Windows\StartupHelper.exe"C:\Windows\StartupHelper.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1996 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F3⤵
- System Location Discovery: System Language Discovery
PID:1544
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 13⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1948
-
-
-
C:\Windows\StartupHelper.exeC:\Windows\StartupHelper.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:396 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:4444
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2576
-
-
C:\Windows\StartupHelper.exeC:\Windows\StartupHelper.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1980 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:2928
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Windows\StartupHelper.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:788
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
408B
MD540b0c3caa1b14a4c83e8475c46bf2016
SHA1af9575cda4d842f028d18b17063796a894ecd9d0
SHA25670e88a428d92b6ab5905dac9f324824c4c6f120bc3f385c82b2d12f707a4a867
SHA512916437df737de4b6063b7116b4d148229d4a975eb4046122d47434b81fba06e88e09e5f273ec496c81ef3feecb843ccad20a7a04074224416c1fa9951acbdac7
-
Filesize
164KB
MD51ebb888eb774b33e4f91d7dad2c00737
SHA1f272c1a38563aa52d40dad5234ec3a5284768e26
SHA25656f285a53d29f7f9db72780ceaf8a053dda0d9f6a8410bc4ab493b830a965e9f
SHA512beb867449918c2ace20abf0b92654c6eee5bca74dc4af8053cb31f838775e96350e40c4a6ea7067d24c4f53b5b767d6e343623ef8faa37847165c82a00cff1c6