f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4

Resubmissions

05/02/2025, 09:07

250205-k2954azkgs 10

09/01/2025, 06:23

250109-g5njqa1pfz 10

Analysis

max time kernel
121s
max time network
122s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
05/02/2025, 09:07

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Size

56KB
MD5

3f2cb535fc5bc296aa5b0d2897c265d0
SHA1

c30358563fa940eb5cd6064d4d16defee43b0310
SHA256

f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
SHA512

6fc3a98f16f4fbd2e6bd4211c35b403ed565d6b30f803e6da04e14efe018aca09719256f1e8a2c8a5763a7bac08de3be964eb6251d858df0f6261f82b3f2f7a2
SSDEEP

768:piN4q1eksgR4SiI+rxQ3rjFrXRRWxXyw/Afy8fIaJ/ZB49j9xOOLC9kvAx0:g4HHerjZX7pLjJKjSO+i

Score

5^/10

discovery

Malware Config

Signatures

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Modifies data under HKEY_USERS 11 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\Control Panel\International	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2824	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
2824	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeBackupPrivilege	2872	vssvc.exe
Token: SeRestorePrivilege	2872	vssvc.exe
Token: SeAuditPrivilege	2872	vssvc.exe

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 2728 wrote to memory of 2824	2728	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	31
PID 2728 wrote to memory of 2824	2728	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	31
PID 2728 wrote to memory of 2824	2728	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	31
PID 2728 wrote to memory of 2824	2728	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	31
PID 2728 wrote to memory of 2824	2728	f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe	31

Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
ransomware

C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe dsrm -subtree -noprompt -c user"http://+:443"
1⤵
PID:1228

C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
"C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe" srm -subtree -noprompt -c user"http://+:443"
1⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2728
- C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe
  "C:\Users\Admin\AppData\Local\Temp\f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4.exe" srm -subtree -noprompt -c user"http://+:443"
  2⤵
  - Drops file in System32 directory
  - System Location Discovery: System Language Discovery
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  PID:2824

C:\Windows\system32\vssvc.exe
C:\Windows\system32\vssvc.exe
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:2872

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Windows 7 deprecation

Loading Replay Monitor...