489fa719739ec1613adea999befb747412438ad80d401908f9c52fa351e36941

Analysis

max time kernel
119s
max time network
120s
platform
windows7_x64
resource
win7-20241010-en
resource tags

arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system
submitted
25-12-2024 20:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
Size

709KB
MD5

32613271f1feb2834ac33ea16807496f
SHA1

40cde9168a856b0b0b05727cffb6977a641b2274
SHA256

fca8d992734405f7ad3c622fa1f990f7b0e1b3949b6a174ad5b1f8a929f93dc9
SHA512

52fb48e81672996925385d681c30aca3d59e9f29b6737caf440461cdf181d7f384bc62b56759bf08be1fa875fd756437e511c39408a8477516422cb4859c0170
SSDEEP

12288:VNC2RmaGseL5pRuAoeOAGQbd5Y48dlDCKb2gb3IU3ScaFlSNS:Vs2RzPo5oeOAh382S9VaQS

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2900	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 3 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
572	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
2900	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
Token: SeDebugPrivilege	2900	powershell.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 2996 wrote to memory of 2900	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	31
PID 2996 wrote to memory of 2900	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	31
PID 2996 wrote to memory of 2900	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	31
PID 2996 wrote to memory of 2900	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	31
PID 2996 wrote to memory of 572	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	33
PID 2996 wrote to memory of 572	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	33
PID 2996 wrote to memory of 572	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	33
PID 2996 wrote to memory of 572	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	33
PID 2996 wrote to memory of 2124	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	35
PID 2996 wrote to memory of 2124	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	35
PID 2996 wrote to memory of 2124	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	35
PID 2996 wrote to memory of 2124	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	35
PID 2996 wrote to memory of 2112	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	36
PID 2996 wrote to memory of 2112	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	36
PID 2996 wrote to memory of 2112	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	36
PID 2996 wrote to memory of 2112	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	36
PID 2996 wrote to memory of 2376	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	37
PID 2996 wrote to memory of 2376	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	37
PID 2996 wrote to memory of 2376	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	37
PID 2996 wrote to memory of 2376	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	37
PID 2996 wrote to memory of 1768	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	38
PID 2996 wrote to memory of 1768	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	38
PID 2996 wrote to memory of 1768	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	38
PID 2996 wrote to memory of 1768	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	38
PID 2996 wrote to memory of 1780	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	39
PID 2996 wrote to memory of 1780	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	39
PID 2996 wrote to memory of 1780	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	39
PID 2996 wrote to memory of 1780	2996	New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe	39

C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
"C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2996
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\SZHsAIbw.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2900
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\SZHsAIbw" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4154.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:572
- C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe"
  2⤵
  PID:2124
- C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe"
  2⤵
  PID:2112
- C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe"
  2⤵
  PID:2376
- C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe"
  2⤵
  PID:1768
- C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe
  "C:\Users\Admin\AppData\Local\Temp\New Order WID-12874 (VT-10622)_SCHW_Juni 22.exe"
  2⤵
  PID:1780

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp4154.tmp

Filesize
1KB

MD5
a3e8a92917e3fe3e12f38073d09844b5

SHA1
c4f78e7335a28256cb90144f5a68dc28c3df9545

SHA256
02652764eb4ce8c6d3226d02c75907a5b7c2ca53e1287c4f53bf54acacd96550

SHA512
907c1f2f04ed4c9643ac7e99cd8551ce5055f0488123be9e000c4c42a177f959106c62b7158ce7807f68b92816400de110658de61a654031ec1d2eb6534a0a9e

Download Submit
memory/2996-0-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2996-1-0x00000000003A0000-0x0000000000458000-memory.dmp

Filesize
736KB

Download
memory/2996-2-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2996-3-0x0000000000210000-0x0000000000224000-memory.dmp

Filesize
80KB

Download
memory/2996-4-0x000000007428E000-0x000000007428F000-memory.dmp

Filesize
4KB

Download
memory/2996-5-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download
memory/2996-6-0x0000000000260000-0x000000000026A000-memory.dmp

Filesize
40KB

Download
memory/2996-7-0x0000000004F50000-0x0000000004FBC000-memory.dmp

Filesize
432KB

Download
memory/2996-13-0x00000000044E0000-0x0000000004514000-memory.dmp

Filesize
208KB

Download
memory/2996-16-0x0000000074280000-0x000000007496E000-memory.dmp

Filesize
6.9MB

Download