7ea98bae6d7f0176c1ae6cecc9bfbc8611304fe007899d8d989425c7b13f3339

Analysis

max time kernel
117s
max time network
118s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
21/01/2025, 12:31

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
PO#98540-00.exe
Size 861KB
Sample250121-pp2emstkhs
SHA256 7ea98bae6d7f0176c1ae6cecc9bfbc8611304fe007899d8d989425c7b13f3339
MD5 1f18bd29f6a4fb2f71e17aea72f0ee7b
SHA1 93eac0c896f16f36ac6e8da8724836782f6a2117
SHA512 cec549f019a877487e5b3a2173778fab231ee79719b82aeac4e3b10f070afe1e639077b60ff3a3daf611f08c95f00693b786b22fad35bed802220c6d00d1c18c
SSDEEP 12288:5q5IO8DfRJI6kmhMB13gQdvUKpRK+YN+XHfEycIYBmqXhHst1WXZ:5q6fRaoMB1wQdvjw+THf7EXhHst0J
MD5 SHA1 SHA512 SSDEEP

Score

8^/10

discovery execution

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
2620	powershell.exe
2740	powershell.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1864 set thread context of 2556	1864	PO#98540-00.exe	37

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	PO#98540-00.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	powershell.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	schtasks.exe

Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2728	schtasks.exe

Suspicious behavior: EnumeratesProcesses 11 IoCs

pid	Process
1864	PO#98540-00.exe
1864	PO#98540-00.exe
2620	powershell.exe
2740	powershell.exe
2556	RegSvcs.exe
2556	RegSvcs.exe
2556	RegSvcs.exe
2556	RegSvcs.exe
2556	RegSvcs.exe
2556	RegSvcs.exe
2556	RegSvcs.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1864	PO#98540-00.exe
Token: SeDebugPrivilege	2620	powershell.exe
Token: SeDebugPrivilege	2740	powershell.exe

Suspicious use of WriteProcessMemory 22 IoCs

description	pid	Process	procid_target
PID 1864 wrote to memory of 2620	1864	PO#98540-00.exe	31
PID 1864 wrote to memory of 2620	1864	PO#98540-00.exe	31
PID 1864 wrote to memory of 2620	1864	PO#98540-00.exe	31
PID 1864 wrote to memory of 2620	1864	PO#98540-00.exe	31
PID 1864 wrote to memory of 2740	1864	PO#98540-00.exe	33
PID 1864 wrote to memory of 2740	1864	PO#98540-00.exe	33
PID 1864 wrote to memory of 2740	1864	PO#98540-00.exe	33
PID 1864 wrote to memory of 2740	1864	PO#98540-00.exe	33
PID 1864 wrote to memory of 2728	1864	PO#98540-00.exe	35
PID 1864 wrote to memory of 2728	1864	PO#98540-00.exe	35
PID 1864 wrote to memory of 2728	1864	PO#98540-00.exe	35
PID 1864 wrote to memory of 2728	1864	PO#98540-00.exe	35
PID 1864 wrote to memory of 2556	1864	PO#98540-00.exe	37
PID 1864 wrote to memory of 2556	1864	PO#98540-00.exe	37
PID 1864 wrote to memory of 2556	1864	PO#98540-00.exe	37
PID 1864 wrote to memory of 2556	1864	PO#98540-00.exe	37
PID 1864 wrote to memory of 2556	1864	PO#98540-00.exe	37
PID 1864 wrote to memory of 2556	1864	PO#98540-00.exe	37
PID 1864 wrote to memory of 2556	1864	PO#98540-00.exe	37
PID 1864 wrote to memory of 2556	1864	PO#98540-00.exe	37
PID 1864 wrote to memory of 2556	1864	PO#98540-00.exe	37
PID 1864 wrote to memory of 2556	1864	PO#98540-00.exe	37

C:\Users\Admin\AppData\Local\Temp\PO#98540-00.exe
"C:\Users\Admin\AppData\Local\Temp\PO#98540-00.exe"
1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1864
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\PO#98540-00.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2620
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\ZgSwAbBKbQrN.exe"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:2740
- C:\Windows\SysWOW64\schtasks.exe
  "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\ZgSwAbBKbQrN" /XML "C:\Users\Admin\AppData\Local\Temp\tmpF91E.tmp"
  2⤵
  - System Location Discovery: System Language Discovery
  - Scheduled Task/Job: Scheduled Task
  PID:2728
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2556

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

tmpF91E.tmp

Path C:\Users\Admin\AppData\Local\Temp\tmpF91E.tmp
Size 1KB
SHA256 86c185a1b593e99f039c67a0fde35327be967684553cddf4d21acdeacc12fa1b
MD5 9baf2f78ee97d84d0edd170a9ef7aa7a
SHA1 633c3677f14b60bf64ff87ed69ecb13aa798cd2b
SHA512 6785fc197b9be38eb37ee44e26fbeb7073cab5fa98a8fe83117b293635423c912b3506ce562bb61ff51c469e5da384f0dcd570cbf1dce6e12bab0dc6d6dcf954
MD5 SHA1 SHA512

Submit Download

INO31IDCEZSF4CMJXPBT.temp

Path C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\INO31IDCEZSF4CMJXPBT.temp
Size 7KB
SHA256 8bf7bb1da970895f401532c929ab9ca88477b192c668773a60cfa46864f29270
MD5 cf85571e65a34f0510fadeda5b573203
SHA1 e3ea471918656479a30a3802fc7f50748ed6350c
SHA512 7382d4d17bb6a538d97417394d4ca31d4d1c7c782aa09ad2dc416dab7089ccd6e3a2cebb037f5ce97d58958b2c413ac759ac4bb7795c904e0195e10dcbec8ca9
SSDEEP 96:EJHOCNM8qnqvsqvJCwonJHOCNM8qnqvsEHyqvJCworMAykQHmH7HhXlUVe:UH7mUoJH7mAHnorMqTH7Hhx
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/1864-6-0x0000000000960000-0x00000000009F2000-memory.dmp

Download

memory/1864-3-0x0000000000330000-0x0000000000356000-memory.dmp

Download

memory/1864-4-0x000000007474E000-0x000000007474F000-memory.dmp

Download

memory/1864-5-0x0000000074740000-0x0000000074E2E000-memory.dmp

Download

memory/1864-0-0x000000007474E000-0x000000007474F000-memory.dmp

Download

memory/1864-2-0x0000000074740000-0x0000000074E2E000-memory.dmp

Download

memory/1864-1-0x0000000000C00000-0x0000000000CDE000-memory.dmp

Download

memory/1864-25-0x0000000074740000-0x0000000074E2E000-memory.dmp

Download

memory/2556-21-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2556-24-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2556-20-0x0000000000400000-0x0000000000447000-memory.dmp

Download

memory/2556-23-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Download