d7108405eebedbd1d610c13bd7dae066a7ca5497f7e1c8c977a92b8401083709

Analysis

max time kernel
4s
max time network
154s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:09

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

2ab11ad915b74ff1dd9a0ab743f7bb2a.exe
Size

5.7MB
MD5

2ab11ad915b74ff1dd9a0ab743f7bb2a
SHA1

b0d2258559eb5d5bd58af52e68fe17fa4f99109c
SHA256

09b4c204845790b4a2cb57a569ee7151d94e038099e3c175807aa27e68bd919c
SHA512

a4cec88eba462ad4e20f267806379054629b736db8c670d7cccfa0ca12a97deb2152ea63b5371662701ca70ea214a029918f584ae89a0187c5ed81253b06a656
SSDEEP

98304:6b4j5YtLaDORGGPAgOUeocP/cjsuS34/4ccmvgJ9FzpI4iWBPzL6OKsgsXPhU4ln:6U5YdUGEJl+oI/BcqgD1SeLuOKsg8BEy

Score

8^/10

execution persistence

Malware Config

Signatures

Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs

Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

execution

PowerShell

T1059.001

pid	Process
4504	powershell.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\Control Panel\International\Geo\Nation	2ab11ad915b74ff1dd9a0ab743f7bb2a.exe

Executes dropped EXE 2 IoCs

pid	Process
5956	Bootstrapper.exe
4764	sqqcmm1n4vf4qj95.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1062200478-553497403-3857448183-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\sqqcmm1n4vf4qj95 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\sqqcmm1n4vf4qj95.exe"	2ab11ad915b74ff1dd9a0ab743f7bb2a.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Scheduled Task/Job: Scheduled Task 1 TTPs 2 IoCs

Schtasks is often used by malware for persistence or to perform post-infection execution.

persistence execution

Scheduled Task

T1053.005

pid	Process
2000	schtasks.exe
3780	schtasks.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
4504	powershell.exe
4504	powershell.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	4504	powershell.exe
Token: SeDebugPrivilege	5956	Bootstrapper.exe
Token: SeDebugPrivilege	4764	sqqcmm1n4vf4qj95.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 5900 wrote to memory of 5956	5900	2ab11ad915b74ff1dd9a0ab743f7bb2a.exe	87
PID 5900 wrote to memory of 5956	5900	2ab11ad915b74ff1dd9a0ab743f7bb2a.exe	87
PID 5900 wrote to memory of 4504	5900	2ab11ad915b74ff1dd9a0ab743f7bb2a.exe	89
PID 5900 wrote to memory of 4504	5900	2ab11ad915b74ff1dd9a0ab743f7bb2a.exe	89
PID 5900 wrote to memory of 4764	5900	2ab11ad915b74ff1dd9a0ab743f7bb2a.exe	91
PID 5900 wrote to memory of 4764	5900	2ab11ad915b74ff1dd9a0ab743f7bb2a.exe	91

C:\Users\Admin\AppData\Local\Temp\2ab11ad915b74ff1dd9a0ab743f7bb2a.exe
"C:\Users\Admin\AppData\Local\Temp\2ab11ad915b74ff1dd9a0ab743f7bb2a.exe"
1⤵
- Checks computer location settings
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:5900
- C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe
  "C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:5956
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" -ExecutionPolicy Bypass Add-MpPreference -ExclusionPath 'C:\Users\Admin\AppData\Local\Temp\sqqcmm1n4vf4qj95.exe'
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:4504
- C:\Users\Admin\AppData\Local\Temp\sqqcmm1n4vf4qj95.exe
  "C:\Users\Admin\AppData\Local\Temp\sqqcmm1n4vf4qj95.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of AdjustPrivilegeToken
  PID:4764
- - C:\Windows\SYSTEM32\CMD.exe
    "CMD" netsh firewall add allowedprogram "C:\Users\Public\Pictures\smssSystem32.exe" WindowsControl ENABLE & exit
    3⤵
    PID:5696
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Public\Pictures\smssSystem32.exe" /RL HIGHEST & exit
    3⤵
    PID:3352
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 1 /tn "Microsoft\Windows\WAppCrashNvTew" /tr "C:\Users\Public\Pictures\smssSystem32.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:3780
- - C:\Windows\SYSTEM32\cmd.exe
    "cmd" /c schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\smssSystem32.exe" /RL HIGHEST & exit
    3⤵
    PID:4068
  - - C:\Windows\system32\schtasks.exe
      schtasks /create /f /sc minute /mo 30 /tn "Microsoft\MachineCore" /tr "C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCookies\smssSystem32.exe" /RL HIGHEST
      4⤵
      Scheduled Task/Job: Scheduled Task
      PID:2000
- - C:\Users\Public\Pictures\smssSystem32.exe
    "C:\Users\Public\Pictures\smssSystem32.exe"
    3⤵
    PID:1696

C:\Users\Public\Pictures\smssSystem32.exe
C:\Users\Public\Pictures\smssSystem32.exe
1⤵
PID:5796

C:\Users\Public\Pictures\smssSystem32.exe
C:\Users\Public\Pictures\smssSystem32.exe
1⤵
PID:3400

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Scheduled Task/Job

T1053

Scheduled Task

T1053.005

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\smssSystem32.exe.log

Filesize
642B

MD5
e19ed69089e56bbfaaba5e5e63d0354f

SHA1
287519bf7c4ec630e4326db00809f627f927ebef

SHA256
f9481e31897c3d9071b744e1638942b52c46858c16ccf692f5c6e109a8b092f6

SHA512
c4a8678d28eea4c3a3adfe0324943478efabef839d3bdacb0e4c278e97ee356037c0bfd83b096952b43d81af0b7253eb7d666416e0024ce93a1c516a834fd05b

Download Submit
C:\Users\Admin\AppData\Local\Temp\Bootstrapper.exe

Filesize
9.4MB

MD5
f2a6133b7f38fc49f792ae799d1b4750

SHA1
6bef46ddde325f45a0e9ff123112c96bbd47c795

SHA256
37bde6655e1272e159b9c2e3a7eee3f4e9a837c0f04240645d3991d112287f8d

SHA512
f9611bed83b4bce1841868880a42dacb6b8f7e8859be1d85b3c8d3a365a0244566cbfb12294c7b2c82b15d6c0e47095d8246a95d522c3a064a0d8511b2411254

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_eq2dksj4.uif.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\sqqcmm1n4vf4qj95.exe

Filesize
290KB

MD5
7b5fb78ea05e503081f53a223858181c

SHA1
2d6d4187e52fa65be9fcd43717de87ebffb3d679

SHA256
9a46574df4ed1df8497bdc34334ea9cd280e77935d580e2d34125ba9906a5802

SHA512
3b6c9e5b82b4157adcaf712745c068f1e679e327aee9467f5100971244ecbc5bc9a686aaed3f5a6ac727303a2e0ed146b059d4a42a059ae801e863ed2d3bc89e

Download Submit
C:\Windows\xdwd.dll

Filesize
136KB

MD5
16e5a492c9c6ae34c59683be9c51fa31

SHA1
97031b41f5c56f371c28ae0d62a2df7d585adaba

SHA256
35c8d022e1d917f1aabdceae98097ccc072161b302f84c768ca63e4b32ac2b66

SHA512
20fd369172ef5e3e2fde388666b42e8fe5f0c2bfa338c0345f45e98af6561a249ba3ecc48c3f16efcc73f02ecb67b3ddb1e2e8f0e77d18fa00ac34e6379e50b6

Download Submit
memory/4504-16-0x000001E76BFE0000-0x000001E76C002000-memory.dmp

Filesize
136KB

Download
memory/4504-21-0x00007FF80D2E0000-0x00007FF80DDA1000-memory.dmp

Filesize
10.8MB

Download
memory/4504-22-0x00007FF80D2E0000-0x00007FF80DDA1000-memory.dmp

Filesize
10.8MB

Download
memory/4504-23-0x00007FF80D2E0000-0x00007FF80DDA1000-memory.dmp

Filesize
10.8MB

Download
memory/4504-26-0x00007FF80D2E0000-0x00007FF80DDA1000-memory.dmp

Filesize
10.8MB

Download
memory/4764-39-0x0000000000EF0000-0x0000000000F3E000-memory.dmp

Filesize
312KB

Download
memory/5900-3-0x00007FF80D2E0000-0x00007FF80DDA1000-memory.dmp

Filesize
10.8MB

Download
memory/5900-0-0x00007FF80D2E3000-0x00007FF80D2E5000-memory.dmp

Filesize
8KB

Download
memory/5900-40-0x00007FF80D2E0000-0x00007FF80DDA1000-memory.dmp

Filesize
10.8MB

Download
memory/5900-1-0x0000000000110000-0x00000000006CA000-memory.dmp

Filesize
5.7MB

Download