Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2025 10:59
Behavioral task
behavioral1
Sample
b2142649.exe
Resource
win7-20240708-en
Behavioral task
behavioral2
Sample
b2142649.exe
Resource
win10v2004-20241007-en
General
-
Target
b2142649.exe
-
Size
224KB
-
MD5
95c08c6bdade25e84a4536396760af3a
-
SHA1
2135bdd1c6de0e38e5c5814f8aed95d26e7534a3
-
SHA256
97756a3aba636c16c10852a994291250619678bc677fadbe358487d95309ecaa
-
SHA512
bef843c0b30a149ba1fb702cd680fb3a4839429b44343124363324153ffa011ea27e512703e16456f3291932911a4d5dab58b76d0446cc502b6666caafe80ca7
-
SSDEEP
3072:3vtV3ROZ6RDwrR3wMUzUVwQ3rInyRnIvPak3hhiHFSbuZhuNcZVKBzqm8LHIkbGB:ftV3euVz6rKyS3yHFHhuNcPKpwU+
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 2 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation b2142649.exe Key value queried \REGISTRY\USER\S-1-5-21-3442511616-637977696-3186306149-1000\Control Panel\International\Geo\Nation pdates.exe -
Executes dropped EXE 4 IoCs
pid Process 3876 pdates.exe 1008 pdates.exe 3124 pdates.exe 5096 pdates.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 10 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language pdates.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b2142649.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2892 schtasks.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2968 b2142649.exe -
Suspicious use of WriteProcessMemory 27 IoCs
description pid Process procid_target PID 2968 wrote to memory of 3876 2968 b2142649.exe 82 PID 2968 wrote to memory of 3876 2968 b2142649.exe 82 PID 2968 wrote to memory of 3876 2968 b2142649.exe 82 PID 3876 wrote to memory of 2892 3876 pdates.exe 83 PID 3876 wrote to memory of 2892 3876 pdates.exe 83 PID 3876 wrote to memory of 2892 3876 pdates.exe 83 PID 3876 wrote to memory of 1440 3876 pdates.exe 85 PID 3876 wrote to memory of 1440 3876 pdates.exe 85 PID 3876 wrote to memory of 1440 3876 pdates.exe 85 PID 1440 wrote to memory of 4348 1440 cmd.exe 87 PID 1440 wrote to memory of 4348 1440 cmd.exe 87 PID 1440 wrote to memory of 4348 1440 cmd.exe 87 PID 1440 wrote to memory of 3932 1440 cmd.exe 88 PID 1440 wrote to memory of 3932 1440 cmd.exe 88 PID 1440 wrote to memory of 3932 1440 cmd.exe 88 PID 1440 wrote to memory of 1272 1440 cmd.exe 89 PID 1440 wrote to memory of 1272 1440 cmd.exe 89 PID 1440 wrote to memory of 1272 1440 cmd.exe 89 PID 1440 wrote to memory of 5092 1440 cmd.exe 90 PID 1440 wrote to memory of 5092 1440 cmd.exe 90 PID 1440 wrote to memory of 5092 1440 cmd.exe 90 PID 1440 wrote to memory of 2180 1440 cmd.exe 91 PID 1440 wrote to memory of 2180 1440 cmd.exe 91 PID 1440 wrote to memory of 2180 1440 cmd.exe 91 PID 1440 wrote to memory of 4848 1440 cmd.exe 92 PID 1440 wrote to memory of 4848 1440 cmd.exe 92 PID 1440 wrote to memory of 4848 1440 cmd.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2142649.exe"C:\Users\Admin\AppData\Local\Temp\b2142649.exe"1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe"2⤵
- Checks computer location settings
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC MINUTE /MO 1 /TN pdates.exe /TR "C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe" /F3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:2892
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k echo Y|CACLS "pdates.exe" /P "Admin:N"&&CACLS "pdates.exe" /P "Admin:R" /E&&echo Y|CACLS "..\925e7e99c5" /P "Admin:N"&&CACLS "..\925e7e99c5" /P "Admin:R" /E&&Exit3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
- System Location Discovery: System Language Discovery
PID:4348
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:N"4⤵
- System Location Discovery: System Language Discovery
PID:3932
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "pdates.exe" /P "Admin:R" /E4⤵
- System Location Discovery: System Language Discovery
PID:1272
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" echo Y"4⤵
- System Location Discovery: System Language Discovery
PID:5092
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:N"4⤵
- System Location Discovery: System Language Discovery
PID:2180
-
-
C:\Windows\SysWOW64\cacls.exeCACLS "..\925e7e99c5" /P "Admin:R" /E4⤵
- System Location Discovery: System Language Discovery
PID:4848
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:1008
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:3124
-
C:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exeC:\Users\Admin\AppData\Local\Temp\925e7e99c5\pdates.exe1⤵
- Executes dropped EXE
PID:5096
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD595c08c6bdade25e84a4536396760af3a
SHA12135bdd1c6de0e38e5c5814f8aed95d26e7534a3
SHA25697756a3aba636c16c10852a994291250619678bc677fadbe358487d95309ecaa
SHA512bef843c0b30a149ba1fb702cd680fb3a4839429b44343124363324153ffa011ea27e512703e16456f3291932911a4d5dab58b76d0446cc502b6666caafe80ca7