667cb510540d8e7a6cd30007d30a8ca11110dde57bd03d2cbf87ca6b7868bdb9

Analysis

max time kernel
142s
max time network
130s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
22/03/2025, 06:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe
Size

50.8MB
MD5

272ac1334eee433b37db2477cf45b100
SHA1

3a0f26e058b1cad27accfcb0f8cdc58d5ebb1146
SHA256

efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542
SHA512

4565c9b13522dd619c36b8df04f5ff873a89ee559fbe97cd7f53d4db24b9e6c125dbaa5e87178241de07ad2d2f2fd98e5ecff8c233e730ff6031545d4b600869
SSDEEP

1572864:VeWso3p+etILvQobxYcU6oBOHH94dpDyNcdJxkU2d:VHss+h3QZOHH8yCm5d

Score

7^/10

defense_evasion discovery

Malware Config

Signatures

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nobodywife.lnk	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe

Executes dropped EXE 2 IoCs

pid	Process
2124	Answer Away.exe
1868	Answer Away.exe

Loads dropped DLL 1 IoCs

pid	Process
2060	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2124 set thread context of 1868	2124	Answer Away.exe	34

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\ProgramData\Moment Tree\Answer Away.exe:ZONE.identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Answer Away.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	Answer Away.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\ProgramData\Moment Tree\Answer Away.exe:ZONE.identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2060	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe
2124	Answer Away.exe
2124	Answer Away.exe
2124	Answer Away.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2060	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe
Token: SeDebugPrivilege	2124	Answer Away.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1868	Answer Away.exe

Suspicious use of WriteProcessMemory 14 IoCs

description	pid	Process	procid_target
PID 2060 wrote to memory of 2012	2060	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe	31
PID 2060 wrote to memory of 2012	2060	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe	31
PID 2060 wrote to memory of 2012	2060	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe	31
PID 2060 wrote to memory of 2012	2060	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe	31
PID 2060 wrote to memory of 2124	2060	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe	33
PID 2060 wrote to memory of 2124	2060	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe	33
PID 2060 wrote to memory of 2124	2060	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe	33
PID 2060 wrote to memory of 2124	2060	efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe	33
PID 2124 wrote to memory of 1868	2124	Answer Away.exe	34
PID 2124 wrote to memory of 1868	2124	Answer Away.exe	34
PID 2124 wrote to memory of 1868	2124	Answer Away.exe	34
PID 2124 wrote to memory of 1868	2124	Answer Away.exe	34
PID 2124 wrote to memory of 1868	2124	Answer Away.exe	34
PID 2124 wrote to memory of 1868	2124	Answer Away.exe	34

C:\Users\Admin\AppData\Local\Temp\efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe
"C:\Users\Admin\AppData\Local\Temp\efbf15e364864659166a08e05a57ab9442dff6c9ae950a3171de120c49dd0542.exe"
1⤵
- Drops startup file
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2060
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > "C:\ProgramData\Moment Tree\Answer Away.exe":ZONE.identifier
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:2012
- C:\ProgramData\Moment Tree\Answer Away.exe
  "C:\ProgramData\Moment Tree\Answer Away.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of SetThreadContext
  - System Location Discovery: System Language Discovery
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2124
- - C:\ProgramData\Moment Tree\Answer Away.exe
    "C:\ProgramData\Moment Tree\Answer Away.exe"
    3⤵
    - Executes dropped EXE
    - System Location Discovery: System Language Discovery
    - Suspicious use of SetWindowsHookEx
    PID:1868

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab533E.tmp

Filesize
70KB

MD5
49aebf8cbd62d92ac215b2923fb1b9f5

SHA1
1723be06719828dda65ad804298d0431f6aff976

SHA256
b33efcb95235b98b48508e019afa4b7655e80cf071defabd8b2123fc8b29307f

SHA512
bf86116b015fb56709516d686e168e7c9c68365136231cc51d0b6542ae95323a71d2c7acec84aad7dcecc2e410843f6d82a0a6d51b9acfc721a9c84fdd877b5b

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Nobodywife.lnk

Filesize
928B

MD5
0bc0caf0dbe779ba0aa1b219619c9d5f

SHA1
2c55dcc43be01dcae7134c981381fc222cc991ff

SHA256
8be76ed790516bda2d419199ec6f32dd06884358a3c5b5244b815ef948e715b3

SHA512
e856458ab33620ef5817c2db5dcd53f367ab908d23ff71e209bcd5e6ce8605b8f0cb8f366bbd725e198147f0c9e244d1f86d59170b4512fcc7c8d80680c02fbd

Download Submit
memory/1868-35-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1868-37-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/1868-38-0x0000000000400000-0x0000000000432000-memory.dmp

Filesize
200KB

Download
memory/2060-11-0x0000000074FD0000-0x000000007557B000-memory.dmp

Filesize
5.7MB

Download
memory/2060-23-0x0000000074FD0000-0x000000007557B000-memory.dmp

Filesize
5.7MB

Download
memory/2060-0-0x0000000074FD1000-0x0000000074FD2000-memory.dmp

Filesize
4KB

Download
memory/2060-10-0x0000000074FD0000-0x000000007557B000-memory.dmp

Filesize
5.7MB

Download
memory/2060-2-0x0000000074FD0000-0x000000007557B000-memory.dmp

Filesize
5.7MB

Download
memory/2060-1-0x0000000074FD0000-0x000000007557B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-25-0x0000000074FD0000-0x000000007557B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-24-0x0000000074FD0000-0x000000007557B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-33-0x0000000074FD0000-0x000000007557B000-memory.dmp

Filesize
5.7MB

Download
memory/2124-39-0x0000000074FD0000-0x000000007557B000-memory.dmp

Filesize
5.7MB

Download