ca912d6c76152192dd0e1ce436ff328ae29973b912919cbb398dc7efd412ecfe

Analysis

max time kernel
149s
max time network
149s
platform
windows10-2004_x64
resource
win10v2004-20250217-en
resource tags

arch:x64arch:x86image:win10v2004-20250217-enlocale:en-usos:windows10-2004-x64system
submitted
18/02/2025, 03:15

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b4b19d78dc58f23e2ecb410af891a9a9.exe
Size 484KB
Sample250218-drywrawqdn
SHA256 ca912d6c76152192dd0e1ce436ff328ae29973b912919cbb398dc7efd412ecfe
MD5 b4b19d78dc58f23e2ecb410af891a9a9
SHA1 e4f45af546acc0b2d9d7bfb0deafa656bddb4b9e
SHA512 64e8f31716b6438bcf600421da28c6519980ea92dde44a294a19b9d12b0c5a212f18258bb10f894e93c654ebf6e6fb6dd4337ab0de3a5c0011ecf91b778f28af
SSDEEP 12288:QLMEalqxXblqoRX5qbfphLxaO3qX+t4+K:cqaXNabfphLxa4w+K
MD5 SHA1 SHA512 SSDEEP

Score

7^/10

discovery execution

Malware Config

Signatures

Checks computer location settings 2 TTPs 2 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation	b4b19d78dc58f23e2ecb410af891a9a9.exe
Key value queried	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000\Control Panel\International\Geo\Nation	WScript.exe

Executes dropped EXE 1 IoCs

pid	Process
3792	client_decrypted.exe

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
3760	powershell.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 1 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	client_decrypted.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2593460650-190333679-3676257533-1000_Classes\Local Settings	b4b19d78dc58f23e2ecb410af891a9a9.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3760	powershell.exe
3760	powershell.exe

Suspicious use of AdjustPrivilegeToken 38 IoCs

description	pid	Process
Token: SeDebugPrivilege	3760	powershell.exe
Token: SeDebugPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe
Token: 33	3792	client_decrypted.exe
Token: SeIncBasePriorityPrivilege	3792	client_decrypted.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 3972 wrote to memory of 1860	3972	b4b19d78dc58f23e2ecb410af891a9a9.exe	85
PID 3972 wrote to memory of 1860	3972	b4b19d78dc58f23e2ecb410af891a9a9.exe	85
PID 1860 wrote to memory of 3760	1860	WScript.exe	86
PID 1860 wrote to memory of 3760	1860	WScript.exe	86
PID 3760 wrote to memory of 3792	3760	powershell.exe	89
PID 3760 wrote to memory of 3792	3760	powershell.exe	89
PID 3760 wrote to memory of 3792	3760	powershell.exe	89

C:\Users\Admin\AppData\Local\Temp\b4b19d78dc58f23e2ecb410af891a9a9.exe
"C:\Users\Admin\AppData\Local\Temp\b4b19d78dc58f23e2ecb410af891a9a9.exe"
1⤵
- Checks computer location settings
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:3972
- C:\Windows\System32\WScript.exe
  "C:\Windows\System32\WScript.exe" "C:\Users\Admin\AppData\Local\Temp\1.vbs"
  2⤵
  - Checks computer location settings
  - Suspicious use of WriteProcessMemory
  PID:1860
- - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
    "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -NoProfile -ExecutionPolicy Bypass -File "decry.ps1"
    3⤵
    - Command and Scripting Interpreter: PowerShell
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:3760
  - - C:\Users\Admin\AppData\Local\Temp\client_decrypted.exe
      "C:\Users\Admin\AppData\Local\Temp\client_decrypted.exe"
      4⤵
      Executes dropped EXE
      System Location Discovery: System Language Discovery
      Suspicious use of AdjustPrivilegeToken
      PID:3792

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

1.vbs

Path C:\Users\Admin\AppData\Local\Temp\1.vbs
Size 136B
SHA256 0d5bfb248f87cf66ae9960e37161502c17704cae7d7062ed1aa5002905af4e18
MD5 4e50025c651e714e108faa65ea60a364
SHA1 1e71fc69519c9a277ae1a4ccbbb095e4b0d705b5
SHA512 f3c00a5370c4046d15f18706606215bd945e2b84eeb42925bb6346cecdd9cb5d0404418185701389daf93a108e3db4ebb2d08b8f284aa9712af93f567dc32573
MD5 SHA1 SHA512

Submit Download

__PSScriptPolicyTest_noslmsyb.sub.ps1

Path C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_noslmsyb.sub.ps1
Size 60B
SHA256 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7
MD5 d17fe0a3f47be24a6453e9ef58c94641
SHA1 6ab83620379fc69f80c0242105ddffd7d98d5d9d
SHA512 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82
MD5 SHA1 SHA512

Submit Download

client_decrypted.exe

Path C:\Users\Admin\AppData\Local\Temp\client_decrypted.exe
Size 32KB
SHA256 53e7894d66feb041ed109fd8b440c9feb1a5c9caab514528fc53cc905e048c75
MD5 8e988e4a05427ba4ada2799b93863982
SHA1 9faf924fc76af3eeed007659d823e3e6789ed5e2
SHA512 9c06070694f0e58155d841a6de5f3bd3bee5e2efda33140fef2b0ce03a1a7bd2b03de449e116a2bd7d4a64facded5cd309333d69e4f72e72d431c56334a830ab
SSDEEP 384:L0bUe5XB4e0XwOJ4w0Q0mS03AWTxtTUFQqzFVObbF:oT9Bu3H55d3bF
MD5 SHA1 SHA512 SSDEEP

Submit Download

decry.ps1

Path C:\Users\Admin\AppData\Local\Temp\decry.ps1
Size 1KB
SHA256 cc22e1563028a211023d53d77f0ea6e49e5d82681870071f64548dc3374ecc4d
MD5 e9ef0e4ebf1a101dea5b2d9ca2105bd5
SHA1 41cb28ffd670f9608d399944e5a33c3d14d5e727
SHA512 3f564dc3efe722fa6b6191eef39f273a0dafdb0b7e98942b8a12424251c43bb58d6ed9933aa9ec4e6b5b43d19eb551bf240ea134674bcb7293584d6ce1ed52d8
MD5 SHA1 SHA512

Submit Download

programa_crypt.exe

Path C:\Users\Admin\AppData\Local\Temp\programa_crypt.exe
Size 32KB
SHA256 1c7abd44ea2bb48c906dfc98957ffe650ac884789c64faa09c32ce223995e1f3
MD5 831da5904af6fda1b486de2f96b497b8
SHA1 b2a45a48ca828ecf4a0c3c0ee7ff488d2367d530
SHA512 7b3d61f7a232c71a1a61a986e73fad09cc30e8fa9261cc38f26a6c3f27e4d87b158cd1fc7be951829f426bb9f8f885864f5fe2445d49455259128e1acd8172d8
SSDEEP 768:iIAF3Xs5SInUgKIQB0YojFYLRh+5xy9d9KOIi+UOSm:i93cbUZ27pqRhEy5KnZUO7
MD5 SHA1 SHA512 SSDEEP

Submit Download

memory/3760-14-0x000001E5A3F30000-0x000001E5A3F52000-memory.dmp

Download