5e5d5458b8a025c2bc9a6e7998492989732967c9a1019b11d655200adf3686c7

Analysis

max time kernel
150s
max time network
151s
platform
windows10-2004_x64
resource
win10v2004-20250314-en
resource tags

arch:x64arch:x86image:win10v2004-20250314-enlocale:en-usos:windows10-2004-x64system
submitted
22/03/2025, 06:13

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe
Size

231KB
MD5

e3720cc15117291c5c96d88546c2da1f
SHA1

04a4577f2b96829be6706d08baf7c6013ce94b3c
SHA256

833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f
SHA512

a642e269e86e8856eb5b5864a1b75833f3f769aedc4d6e83338e3ee5b71b571f78301b8bf0b9ce5b2570d2def6c0a279018a83180e934cce8a001dc0221f2362
SSDEEP

3072:kvZlKu5E1r1Z2E6o237o7g0e1MIwdvuDFQJjCG4NdBmZK0T/:kvZlKe+BKo23ygPzhQhCNwK0T

Score

8^/10

defense_evasion discovery persistence privilege_escalation

Malware Config

Signatures

Modifies Windows Firewall 2 TTPs 1 IoCs

defense_evasion

Windows Service

T1543.003

Disable or Modify System Firewall

T1562.004

pid	Process
3620	netsh.exe

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-3218366390-1258052702-4267193707-1000\Control Panel\International\Geo\Nation	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe

Executes dropped EXE 1 IoCs

pid	Process
1388	tmp.exe

Subvert Trust Controls: Mark-of-the-Web Bypass 1 TTPs 1 IoCs

When files are downloaded from the Internet, they are tagged with a hidden NTFS Alternate Data Stream (ADS) named Zone.Identifier with a specific value known as the MOTW.

defense_evasion

SIP and Trust Provider Hijacking

T1553.003

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\FolderN\name.exe:Zone.Identifier	cmd.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs

Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.

persistence privilege_escalation

Netsh Helper DLL

T1546.007

description	ioc	Process
Key value enumerated	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key opened	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe
Key queried	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh	netsh.exe

System Location Discovery: System Language Discovery 1 TTPs 7 IoCs

Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

discovery

System Language Discovery

T1614.001

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	tmp.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	reg.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	cmd.exe
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language	netsh.exe

NTFS ADS 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\FolderN\name.exe:Zone.Identifier	cmd.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe
1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe

Suspicious behavior: RenamesItself 1 IoCs

pid	Process
1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe

Suspicious use of AdjustPrivilegeToken 54 IoCs

description	pid	Process
Token: SeDebugPrivilege	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe
Token: SeDebugPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe
Token: 33	1388	tmp.exe
Token: SeIncBasePriorityPrivilege	1388	tmp.exe

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 1388	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	90
PID 1080 wrote to memory of 1388	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	90
PID 1080 wrote to memory of 1388	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	90
PID 1080 wrote to memory of 1728	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	92
PID 1080 wrote to memory of 1728	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	92
PID 1080 wrote to memory of 1728	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	92
PID 1728 wrote to memory of 4352	1728	cmd.exe	94
PID 1728 wrote to memory of 4352	1728	cmd.exe	94
PID 1728 wrote to memory of 4352	1728	cmd.exe	94
PID 1080 wrote to memory of 3052	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	95
PID 1080 wrote to memory of 3052	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	95
PID 1080 wrote to memory of 3052	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	95
PID 1080 wrote to memory of 2640	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	97
PID 1080 wrote to memory of 2640	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	97
PID 1080 wrote to memory of 2640	1080	833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe	97
PID 1388 wrote to memory of 3620	1388	tmp.exe	101
PID 1388 wrote to memory of 3620	1388	tmp.exe	101
PID 1388 wrote to memory of 3620	1388	tmp.exe	101

C:\Users\Admin\AppData\Local\Temp\833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe
"C:\Users\Admin\AppData\Local\Temp\833aad3410b30a9ec5214be9fe616e327c813883502cfa1a0b597de784106c1f.exe"
1⤵
- Checks computer location settings
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Users\Admin\AppData\Local\Temp\tmp.exe
  "C:\Users\Admin\AppData\Local\Temp\tmp.exe"
  2⤵
  - Executes dropped EXE
  - System Location Discovery: System Language Discovery
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1388
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\tmp.exe" "tmp.exe" ENABLE
    3⤵
    - Modifies Windows Firewall
    - Event Triggered Execution: Netsh Helper DLL
    - System Location Discovery: System Language Discovery
    PID:3620
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "%appdata%\FolderN\name.exe.lnk" /f
  2⤵
  - System Location Discovery: System Language Discovery
  - Suspicious use of WriteProcessMemory
  PID:1728
- - C:\Windows\SysWOW64\reg.exe
    reg add "HKCU\Software\Microsoft\Windows NT\CurrentVersion\Windows" /v Load /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\FolderN\name.exe.lnk" /f
    3⤵
    - System Location Discovery: System Language Discovery
    PID:4352
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c echo [zoneTransfer]ZoneID = 2 > %appdata%\FolderN\name.exe:Zone.Identifier
  2⤵
  - Subvert Trust Controls: Mark-of-the-Web Bypass
  - System Location Discovery: System Language Discovery
  - NTFS ADS
  PID:3052
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c ren "%appdata%\FolderN\name.exe.jpg" name.exe
  2⤵
  - System Location Discovery: System Language Discovery
  PID:2640

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Privilege Escalation

Create or Modify System Process

T1543

Windows Service

T1543.003

Event Triggered Execution

T1546

Netsh Helper DLL

T1546.007

Defense Evasion

Impair Defenses

T1562

Disable or Modify System Firewall

T1562.004

Subvert Trust Controls

T1553

SIP and Trust Provider Hijacking

T1553.003

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

System Location Discovery

T1614

System Language Discovery

T1614.001

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp.exe

Filesize
32KB

MD5
1dbfa6282eedc723ebe57ace23fd6b68

SHA1
c827aeb5c20acd10fc7eeccfb77bb0b17b2ac1d5

SHA256
8b5265c26284a2cddfd6cd0735381743b93964efe675dfad9b7ac22447d6d9e7

SHA512
f4043281ac6bbb6db64b2cab28fe3aa5ae5ce7936f3fb474ed48d253fb5f7c18ab81ee6c4267131d150763c9bf180603c64868561f6d0c2e2c76ccf33ddd1ba4

Download Submit
memory/1080-29-0x0000000074FE0000-0x0000000075790000-memory.dmp

Filesize
7.7MB

Download
memory/1080-1-0x0000000000AE0000-0x0000000000B1E000-memory.dmp

Filesize
248KB

Download
memory/1080-2-0x0000000005500000-0x000000000559C000-memory.dmp

Filesize
624KB

Download
memory/1080-3-0x0000000074FE0000-0x0000000075790000-memory.dmp

Filesize
7.7MB

Download
memory/1080-4-0x0000000074FEE000-0x0000000074FEF000-memory.dmp

Filesize
4KB

Download
memory/1080-5-0x0000000002EE0000-0x0000000002EF2000-memory.dmp

Filesize
72KB

Download
memory/1080-7-0x0000000074FE0000-0x0000000075790000-memory.dmp

Filesize
7.7MB

Download
memory/1080-0-0x0000000074FEE000-0x0000000074FEF000-memory.dmp

Filesize
4KB

Download
memory/1080-20-0x00000000066A0000-0x0000000006C44000-memory.dmp

Filesize
5.6MB

Download
memory/1388-19-0x0000000070EC2000-0x0000000070EC3000-memory.dmp

Filesize
4KB

Download
memory/1388-22-0x0000000070EC0000-0x0000000071471000-memory.dmp

Filesize
5.7MB

Download
memory/1388-25-0x0000000070EC2000-0x0000000070EC3000-memory.dmp

Filesize
4KB

Download
memory/1388-26-0x0000000070EC0000-0x0000000071471000-memory.dmp

Filesize
5.7MB

Download
memory/1388-27-0x0000000070EC0000-0x0000000071471000-memory.dmp

Filesize
5.7MB

Download
memory/1388-21-0x0000000070EC0000-0x0000000071471000-memory.dmp

Filesize
5.7MB

Download