Analysis
-
max time kernel
900s -
max time network
889s -
platform
windows10-2004_x64 -
resource
win10v2004-20250129-en -
resource tags
arch:x64arch:x86image:win10v2004-20250129-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2025 22:36
Behavioral task
behavioral1
Sample
brootForce.exe
Resource
win7-20240903-en
windows7-x64
16 signatures
900 seconds
Behavioral task
behavioral2
Sample
brootForce.exe
Resource
win10v2004-20250129-en
windows10-2004-x64
14 signatures
900 seconds
General
-
Target
brootForce.exe
-
Size
167KB
-
MD5
3964190fb6503039acf4c590f1e22b6a
-
SHA1
4201a8f44d2c449e47704ea37351589e51ee1e29
-
SHA256
7c1978631c42844ab98a3580b131b5b279087b9ed2a955c0ff8c22f557ee900e
-
SHA512
b1fffbb9cd0609440648542e73ed76399eef8e9c39a79bea890ca6c7d1026ebdb30fc5ce9786bff274fe659a7a482a60b514a38fc56a42165a5b8c6e0ed7664c
-
SSDEEP
3072:e2qK4C4BoN36t4QviFC0MBn3fWl9zWaF9bPYvM9UJ8T2SXZyrgoBJtbN/3MCK2kV:eKP9zgvMx/JdSI5eb
Score
7/10
Malware Config
Signatures
-
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\Control Panel\International\Geo\Nation brootForce.exe -
Drops startup file 3 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\svchost.url svchost.exe -
Executes dropped EXE 16 IoCs
pid Process 3652 svchost.exe 1812 svchost.exe 4064 svchost.exe 2616 svchost.exe 4916 svchost.exe 3700 svchost.exe 664 svchost.exe 1812 svchost.exe 4948 svchost.exe 3680 svchost.exe 2084 svchost.exe 4308 svchost.exe 4520 svchost.exe 3988 svchost.exe 1076 svchost.exe 1964 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2089655958-977706906-1981639424-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Windows\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost.exe = "\"C:\\Windows\\svchost.exe\" .." svchost.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 2 IoCs
flow ioc 14 0.tcp.eu.ngrok.io 49 0.tcp.eu.ngrok.io -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\svchost.exe brootForce.exe File opened for modification C:\Windows\svchost.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 22 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language choice.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language schtasks.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language brootForce.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe -
Kills process with taskkill 1 IoCs
pid Process 1356 taskkill.exe -
Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3064 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe 3652 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3652 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe Token: SeIncBasePriorityPrivilege 3652 svchost.exe Token: 33 3652 svchost.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3280 wrote to memory of 3652 3280 brootForce.exe 87 PID 3280 wrote to memory of 3652 3280 brootForce.exe 87 PID 3280 wrote to memory of 3652 3280 brootForce.exe 87 PID 3280 wrote to memory of 4532 3280 brootForce.exe 88 PID 3280 wrote to memory of 4532 3280 brootForce.exe 88 PID 3280 wrote to memory of 4532 3280 brootForce.exe 88 PID 4532 wrote to memory of 4884 4532 cmd.exe 90 PID 4532 wrote to memory of 4884 4532 cmd.exe 90 PID 4532 wrote to memory of 4884 4532 cmd.exe 90 PID 3652 wrote to memory of 1356 3652 svchost.exe 91 PID 3652 wrote to memory of 1356 3652 svchost.exe 91 PID 3652 wrote to memory of 1356 3652 svchost.exe 91 PID 3652 wrote to memory of 1316 3652 svchost.exe 93 PID 3652 wrote to memory of 1316 3652 svchost.exe 93 PID 3652 wrote to memory of 1316 3652 svchost.exe 93 PID 3652 wrote to memory of 3064 3652 svchost.exe 95 PID 3652 wrote to memory of 3064 3652 svchost.exe 95 PID 3652 wrote to memory of 3064 3652 svchost.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\brootForce.exe"C:\Users\Admin\AppData\Local\Temp\brootForce.exe"1⤵
- Checks computer location settings
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:3280 -
C:\Windows\svchost.exe"C:\Windows\svchost.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Adds Run key to start application
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3652 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f im discord.exe3⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
PID:1356
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /delete /tn "MicrosoftEdgeUpdateTaskMachine" /f3⤵
- System Location Discovery: System Language Discovery
PID:1316
-
-
C:\Windows\SysWOW64\schtasks.exeschtasks /create /sc minute /mo 1 /tn "MicrosoftEdgeUpdateTaskMachine" /tr C:\Windows\svchost.exe3⤵
- System Location Discovery: System Language Discovery
- Scheduled Task/Job: Scheduled Task
PID:3064
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C choice /C Y /N /D Y /T 5 & Del "C:\Users\Admin\AppData\Local\Temp\brootForce.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4532 -
C:\Windows\SysWOW64\choice.exechoice /C Y /N /D Y /T 53⤵
- System Location Discovery: System Language Discovery
PID:4884
-
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4064
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2616
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4916
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3700
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:664
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1812
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4948
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3680
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:2084
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4308
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:4520
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:3988
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1076
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
PID:1964
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Scheduled Task/Job
1Scheduled Task
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
319B
MD58feef304777dfe95294f842d6d9a3852
SHA19f34db8c6647b7edfe8f4618eab53fc6a6161ea7
SHA256829510e85c0787bb7a291b85b9f38d1e7c122cf07de3829c33e1fba4d06bc97f
SHA512f381d170eeea45b115ad6bc6d27b6f55bfbae00d7694cc8efd18aaa7d17f4d47f1f21de856315c38754ec1181d137923a6d74cd0a0c2d1ec538c80ea8ff9d20b
-
Filesize
167KB
MD53964190fb6503039acf4c590f1e22b6a
SHA14201a8f44d2c449e47704ea37351589e51ee1e29
SHA2567c1978631c42844ab98a3580b131b5b279087b9ed2a955c0ff8c22f557ee900e
SHA512b1fffbb9cd0609440648542e73ed76399eef8e9c39a79bea890ca6c7d1026ebdb30fc5ce9786bff274fe659a7a482a60b514a38fc56a42165a5b8c6e0ed7664c