Analysis Overview
SHA256
4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf
Threat Level: Known bad
The file 4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe was found to be: Known bad.
Malicious Activity Summary
Darkcloud family
DarkCloud
Command and Scripting Interpreter: PowerShell
Checks computer location settings
Suspicious use of SetThreadContext
Enumerates physical storage devices
Unsigned PE
System Location Discovery: System Language Discovery
Suspicious use of AdjustPrivilegeToken
Scheduled Task/Job: Scheduled Task
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
Suspicious use of WriteProcessMemory
Suspicious use of SetWindowsHookEx
MITRE ATT&CK
Enterprise Matrix V15
Analysis: static1
Detonation Overview
Reported
2025-03-08 07:02
Signatures
Unsigned PE
| Description | Indicator | Process | Target |
| N/A | N/A | N/A | N/A |
Analysis: behavioral1
Detonation Overview
Submitted
2025-03-08 07:02
Reported
2025-03-08 07:05
Platform
win7-20240729-en
Max time kernel
140s
Max time network
118s
Command Line
Signatures
DarkCloud
Darkcloud family
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 2340 set thread context of 2852 | N/A | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OjzZfu.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OjzZfu" /XML "C:\Users\Admin\AppData\Local\Temp\tmpC6F.tmp"
C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
Network
Files
memory/2340-0-0x000000007468E000-0x000000007468F000-memory.dmp
memory/2340-1-0x0000000000ED0000-0x0000000000FA8000-memory.dmp
memory/2340-2-0x0000000074680000-0x0000000074D6E000-memory.dmp
memory/2340-3-0x0000000000520000-0x0000000000530000-memory.dmp
memory/2340-4-0x000000007468E000-0x000000007468F000-memory.dmp
memory/2340-5-0x0000000074680000-0x0000000074D6E000-memory.dmp
memory/2340-6-0x00000000055F0000-0x00000000056A8000-memory.dmp
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\AG2B0QEC274DFIV9Z48G.temp
| MD5 | 98ced1703ff20262e849b2af5f8b5cfc |
| SHA1 | 55edcf40e14597b5a5605fb988e85d1869306898 |
| SHA256 | 1589d0686b0b70cfb9eed53fe132a3ab17cb2facb82a8e00dfc11f8ffb83bb89 |
| SHA512 | b5829effdc2357ed652bc221cfd6da5dc87c90f26ca7399d997d4630b86ad18cececb5290fad71309eac11563258d88e0cfbb6a227fcb18bab2971bb5f5ef5bd |
C:\Users\Admin\AppData\Local\Temp\tmpC6F.tmp
| MD5 | 7edf6cb7b4aa49fe1cbd45bc45826dcb |
| SHA1 | 9294a5c2c165ae6e09dd7ffba14727ce14291389 |
| SHA256 | e5e3e34c278c6b02c06d96c36da5a016f20992b8a93a4cbbe8ed5c3c1de59666 |
| SHA512 | 01d9d8d888ec7f0d91c2700b8d316adc2f4e858616d980e190aba2e4e8aa1d330c1c322b0a4b9f52fa7d89f9b55089dd5d2e554f8b935e75f8ee0ea2628628ec |
memory/2852-19-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2852-29-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2852-28-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2852-27-0x000000007EFDE000-0x000000007EFDF000-memory.dmp
memory/2852-23-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2852-21-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2340-32-0x0000000074680000-0x0000000074D6E000-memory.dmp
Analysis: behavioral2
Detonation Overview
Submitted
2025-03-08 07:02
Reported
2025-03-08 07:05
Platform
win10v2004-20250217-en
Max time kernel
147s
Max time network
151s
Command Line
Signatures
DarkCloud
Darkcloud family
Command and Scripting Interpreter: PowerShell
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| N/A | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
Checks computer location settings
| Description | Indicator | Process | Target |
| Key value queried | \REGISTRY\USER\S-1-5-21-3181990009-820930284-137514597-1000\Control Panel\International\Geo\Nation | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | N/A |
Suspicious use of SetThreadContext
| Description | Indicator | Process | Target |
| PID 5080 set thread context of 3944 | N/A | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe |
Enumerates physical storage devices
System Location Discovery: System Language Discovery
| Description | Indicator | Process | Target |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Windows\SysWOW64\schtasks.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | N/A |
| Key opened | \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | N/A |
Scheduled Task/Job: Scheduled Task
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Windows\SysWOW64\schtasks.exe | N/A |
Suspicious behavior: EnumeratesProcesses
Suspicious behavior: GetForegroundWindowSpam
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | N/A |
Suspicious use of AdjustPrivilegeToken
| Description | Indicator | Process | Target |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe | N/A |
| Token: SeDebugPrivilege | N/A | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | N/A |
Suspicious use of SetWindowsHookEx
| Description | Indicator | Process | Target |
| N/A | N/A | C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe | N/A |
Suspicious use of WriteProcessMemory
Processes
C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\OjzZfu.exe"
C:\Windows\SysWOW64\schtasks.exe
"C:\Windows\System32\schtasks.exe" /Create /TN "Updates\OjzZfu" /XML "C:\Users\Admin\AppData\Local\Temp\tmp4BAA.tmp"
C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe
"C:\Users\Admin\AppData\Local\Temp\4db7507380d62465271df29775dd284e6421a2f6848bc9f5eb17188d399e9edf.exe"
Network
| Country | Destination | Domain | Proto |
| US | 8.8.8.8:53 | g.bing.com | udp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
| US | 150.171.27.10:443 | g.bing.com | tcp |
Files
memory/5080-0-0x000000007526E000-0x000000007526F000-memory.dmp
memory/5080-1-0x0000000000600000-0x00000000006D8000-memory.dmp
memory/5080-2-0x0000000005770000-0x0000000005D14000-memory.dmp
memory/5080-3-0x0000000005090000-0x0000000005122000-memory.dmp
memory/5080-4-0x0000000005150000-0x000000000515A000-memory.dmp
memory/5080-5-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/5080-6-0x0000000005740000-0x0000000005750000-memory.dmp
memory/5080-7-0x000000007526E000-0x000000007526F000-memory.dmp
memory/5080-8-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/5080-9-0x00000000064D0000-0x0000000006588000-memory.dmp
memory/5080-10-0x0000000008C20000-0x0000000008CBC000-memory.dmp
memory/4948-15-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/4948-16-0x0000000002DA0000-0x0000000002DD6000-memory.dmp
memory/4948-18-0x0000000005770000-0x0000000005D98000-memory.dmp
memory/4948-17-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/2012-19-0x0000000075260000-0x0000000075A10000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\tmp4BAA.tmp
| MD5 | e2a5de162c4343c2d39b4e13fdf42a38 |
| SHA1 | 288233948a2ce3e833c1ddf6874eb32bd07c98f2 |
| SHA256 | 21de388580a5ad49d0b9d4fe05e0045bda76770fae386220e4e6a7ad787fb2fe |
| SHA512 | 73728778a3815a0fc2ae4ed9ad3a6f34962b8a4657f9eb8e337a61b0aa9e9477a3b95baf670293cea12fbee2d8f7c2d177e6480a7d332121b4a079895d3c5012 |
memory/2012-20-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/4948-22-0x0000000005E20000-0x0000000005E42000-memory.dmp
memory/2012-23-0x0000000075260000-0x0000000075A10000-memory.dmp
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_2qljlfik.usi.ps1
| MD5 | d17fe0a3f47be24a6453e9ef58c94641 |
| SHA1 | 6ab83620379fc69f80c0242105ddffd7d98d5d9d |
| SHA256 | 96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7 |
| SHA512 | 5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82 |
memory/3944-45-0x0000000000400000-0x000000000046D000-memory.dmp
memory/4948-40-0x00000000061A0000-0x00000000064F4000-memory.dmp
memory/3944-46-0x0000000000400000-0x000000000046D000-memory.dmp
memory/2012-25-0x0000000005B10000-0x0000000005B76000-memory.dmp
memory/4948-24-0x0000000005FC0000-0x0000000006026000-memory.dmp
memory/5080-51-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/4948-52-0x0000000006C60000-0x0000000006CAC000-memory.dmp
memory/4948-50-0x00000000066B0000-0x00000000066CE000-memory.dmp
memory/2012-65-0x00000000071D0000-0x00000000071EE000-memory.dmp
memory/4948-60-0x0000000070040000-0x000000007008C000-memory.dmp
memory/2012-54-0x0000000070040000-0x000000007008C000-memory.dmp
memory/2012-53-0x0000000007190000-0x00000000071C2000-memory.dmp
memory/4948-75-0x00000000076E0000-0x0000000007783000-memory.dmp
memory/2012-76-0x0000000007B80000-0x00000000081FA000-memory.dmp
memory/2012-77-0x0000000007530000-0x000000000754A000-memory.dmp
memory/4948-78-0x0000000007A50000-0x0000000007A5A000-memory.dmp
memory/2012-79-0x00000000077B0000-0x0000000007846000-memory.dmp
memory/2012-80-0x0000000007730000-0x0000000007741000-memory.dmp
memory/2012-81-0x0000000007760000-0x000000000776E000-memory.dmp
memory/2012-82-0x0000000007770000-0x0000000007784000-memory.dmp
memory/2012-83-0x0000000007870000-0x000000000788A000-memory.dmp
memory/2012-84-0x0000000007850000-0x0000000007858000-memory.dmp
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\powershell.exe.log
| MD5 | 968cb9309758126772781b83adb8a28f |
| SHA1 | 8da30e71accf186b2ba11da1797cf67f8f78b47c |
| SHA256 | 92099c10776bb7e3f2a8d1b82d4d40d0c4627e4f1bf754a6e58dfd2c2e97042a |
| SHA512 | 4bd50732f8af4d688d95999bddfd296115d7033ddc38f86c9fb1f47fde202bffa27e9088bebcaa3064ca946af2f5c1ca6cbde49d0907f0005c7ab42874515dd3 |
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive
| MD5 | d6a8b68195d75a12548e57f9f4e42b8c |
| SHA1 | bb58d2ff8212b99b6d7896d016c6b166f5a2a67c |
| SHA256 | 4d4f1f68fa79fed495e36142aea32a0e5d2c62c7687df8f57e9d891763776876 |
| SHA512 | dea3ea2fe55c2abb8229d8ba89c167b1c0d83b683ce30043d697f19e9edd675ee8e0ae51e50f8f2302ab25876777083c328a375b4f578f391280774b36510acf |
memory/4948-91-0x0000000075260000-0x0000000075A10000-memory.dmp
memory/2012-92-0x0000000075260000-0x0000000075A10000-memory.dmp