Analysis
-
max time kernel
30s -
max time network
14s -
platform
windows10-ltsc 2021_x64 -
resource
win10ltsc2021-20241211-en -
resource tags
arch:x64arch:x86image:win10ltsc2021-20241211-enlocale:en-usos:windows10-ltsc 2021-x64system -
submitted
26-12-2024 09:46
Behavioral task
behavioral1
Sample
New Client.exe
Resource
win10ltsc2021-20241211-en
windows10-ltsc 2021-x64
10 signatures
30 seconds
General
-
Target
New Client.exe
-
Size
164KB
-
MD5
a422e5226ed43c725560722a2ee75700
-
SHA1
f06f1c3ff313ca5441156bff0b8252ae745bfecf
-
SHA256
af6e0071ee6fb69abca018fd9975cab1680c1d1d8d16864924c0f10db72431f1
-
SHA512
659267c3699744f0a1dd821a27a8452ae377bb37d4251c663a4a777942ba66ec6539f54eb18464b778c3ea2f3d017284306a8ca59d307d094b07dd2a777c8cc9
-
SSDEEP
3072:Z64O/PtrrCkAhs5JKOGY5EOQPwiwXbMLRidIZC1A:Z6IOunwXbMAdMCy
Score
7/10
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini New Client.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\AppCompat\Programs\Amcache.hve.tmp dw20.exe -
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language dw20.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language New Client.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language TASKKILL.exe -
Checks processor information in registry 2 TTPs 3 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString dw20.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS dw20.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU dw20.exe -
Kills process with taskkill 2 IoCs
pid Process 4024 TASKKILL.exe 4804 TASKKILL.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2996 schtasks.exe 1992 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe 4044 New Client.exe -
Suspicious use of AdjustPrivilegeToken 8 IoCs
description pid Process Token: SeDebugPrivilege 4044 New Client.exe Token: SeDebugPrivilege 4804 TASKKILL.exe Token: SeDebugPrivilege 4024 TASKKILL.exe Token: SeRestorePrivilege 1360 dw20.exe Token: SeBackupPrivilege 1360 dw20.exe Token: SeBackupPrivilege 1360 dw20.exe Token: SeBackupPrivilege 1360 dw20.exe Token: SeBackupPrivilege 1360 dw20.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 4044 wrote to memory of 5072 4044 New Client.exe 81 PID 4044 wrote to memory of 5072 4044 New Client.exe 81 PID 4044 wrote to memory of 5072 4044 New Client.exe 81 PID 4044 wrote to memory of 2996 4044 New Client.exe 84 PID 4044 wrote to memory of 2996 4044 New Client.exe 84 PID 4044 wrote to memory of 2996 4044 New Client.exe 84 PID 4044 wrote to memory of 4024 4044 New Client.exe 86 PID 4044 wrote to memory of 4024 4044 New Client.exe 86 PID 4044 wrote to memory of 4024 4044 New Client.exe 86 PID 4044 wrote to memory of 4804 4044 New Client.exe 87 PID 4044 wrote to memory of 4804 4044 New Client.exe 87 PID 4044 wrote to memory of 4804 4044 New Client.exe 87 PID 4044 wrote to memory of 2872 4044 New Client.exe 97 PID 4044 wrote to memory of 2872 4044 New Client.exe 97 PID 4044 wrote to memory of 2872 4044 New Client.exe 97 PID 4044 wrote to memory of 1992 4044 New Client.exe 99 PID 4044 wrote to memory of 1992 4044 New Client.exe 99 PID 4044 wrote to memory of 1992 4044 New Client.exe 99 PID 4044 wrote to memory of 1360 4044 New Client.exe 101 PID 4044 wrote to memory of 1360 4044 New Client.exe 101 PID 4044 wrote to memory of 1360 4044 New Client.exe 101
Processes
-
C:\Users\Admin\AppData\Local\Temp\New Client.exe"C:\Users\Admin\AppData\Local\Temp\New Client.exe"1⤵
- Drops startup file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4044 -
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYANP /F2⤵
- System Location Discovery: System Language Discovery
PID:5072
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYANP /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 52⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2996
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM wscript.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4024
-
-
C:\Windows\SysWOW64\TASKKILL.exeTASKKILL /F /IM cmd.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:4804
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /Delete /tn NYAN /F2⤵
- System Location Discovery: System Language Discovery
PID:2872
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /tn NYAN /tr "C:\Users\Admin\AppData\Local\Temp\New Client.exe" /sc minute /mo 12⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:1992
-
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exedw20.exe -x -s 13162⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:1360
-