Resubmissions

01/07/2025, 06:41

250701-hf9akasp12 10

01/07/2025, 06:22

250701-g43bgsdl5v 10

10/06/2025, 16:01

250610-tgnk2azqw5 10

Analysis

  • max time kernel
    105s
  • max time network
    137s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20250610-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20250610-enlocale:en-usos:windows10-2004-x64system
  • submitted
    01/07/2025, 06:41

General

  • Target

    271JaJbQjMLGbcc.exe

  • Size

    667KB

  • MD5

    17043ee76cd32800262fa06cfc3ac690

  • SHA1

    0f11ac97736fb42fd30d6c4abf1da4549e8f0101

  • SHA256

    6781be8abda50b0cc7d27b9466f7b39572f978cf16151092554e7b4557f0ac06

  • SHA512

    0ec8c106a4d55deee49da8a9696f36cbcfb55872d0d2e982416be34ab7e81faa2b2c12f86575e195093d24b78978691c4c242fe7bdf1ab728a68bf92b57d31d7

  • SSDEEP

    12288:disP8yffxahqfDGZW17k0+YHPEd8MwP0WAra3OjuBGy1kuOEXuVjCqfkR:n8yffxQqbuWZk9DNWAr6u+3OCq6

Score
8/10

Malware Config

Signatures

  • Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

    Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.

  • Checks computer location settings 2 TTPs 1 IoCs

    Looks up country code configured in the registry, likely geofence.

  • Uses the VBS compiler for execution 1 TTPs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • System Location Discovery: System Language Discovery 1 TTPs 4 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Scheduled Task/Job: Scheduled Task 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 16 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe
    "C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe"
    1⤵
    • Checks computer location settings
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2116
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\271JaJbQjMLGbcc.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:4340
    • C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
      "C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\xQKiRiS.exe"
      2⤵
      • Command and Scripting Interpreter: PowerShell
      • System Location Discovery: System Language Discovery
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2788
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\xQKiRiS" /XML "C:\Users\Admin\AppData\Local\Temp\tmpD755.tmp"
      2⤵
      • System Location Discovery: System Language Discovery
      • Scheduled Task/Job: Scheduled Task
      PID:2756
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
      2⤵
        PID:1868
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
        2⤵
          PID:4784
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
          2⤵
            PID:6000
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
            2⤵
              PID:1652
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\vbc.exe"
              2⤵
                PID:5072

            Network

                  MITRE ATT&CK Enterprise v16

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

                    Filesize

                    18KB

                    MD5

                    8814133bfca93253f1a9eb8fb7bae187

                    SHA1

                    29b755a1091ff5ba918148f99ed96eb8cbff2603

                    SHA256

                    5de9df6973ba46855e1ea7ebad91ee19f907755a018e3f45c6fcb9391c559efa

                    SHA512

                    66fed52564da009c4dc93e55cf909581971fba0fccecb459afbc2c889c4d9d8f5eedcc6b75ac26f3518ba7e45a13e2e353fc7fee1193989abbdc4b8f72951352

                  • C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_lbdosseb.hh1.ps1

                    Filesize

                    60B

                    MD5

                    d17fe0a3f47be24a6453e9ef58c94641

                    SHA1

                    6ab83620379fc69f80c0242105ddffd7d98d5d9d

                    SHA256

                    96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

                    SHA512

                    5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

                  • C:\Users\Admin\AppData\Local\Temp\tmpD755.tmp

                    Filesize

                    1KB

                    MD5

                    7eae5f2826cef3c441fdcc7a3d2a7d2f

                    SHA1

                    7234b00bab6ff6369e4e6bcb207cbe82d62bb119

                    SHA256

                    4e8bc60b66dff0c77cdba36d8074016b5932ebfb4959fa5aa89d503243ae17a6

                    SHA512

                    0ee5f855a04250677d77449bb423eb32cea9612bc78932fb41f1d1161e2eb2ccaee6f070d6a24ff325f654b07817ed9c818e957d0ab20ab5d8168a1739bd3240

                  • memory/2116-1-0x0000000005980000-0x0000000005F24000-memory.dmp

                    Filesize

                    5.6MB

                  • memory/2116-2-0x00000000052C0000-0x0000000005352000-memory.dmp

                    Filesize

                    584KB

                  • memory/2116-3-0x0000000005480000-0x0000000005490000-memory.dmp

                    Filesize

                    64KB

                  • memory/2116-4-0x0000000005370000-0x000000000537A000-memory.dmp

                    Filesize

                    40KB

                  • memory/2116-5-0x00000000055E0000-0x000000000567C000-memory.dmp

                    Filesize

                    624KB

                  • memory/2116-6-0x0000000005590000-0x00000000055A0000-memory.dmp

                    Filesize

                    64KB

                  • memory/2116-7-0x0000000005480000-0x0000000005490000-memory.dmp

                    Filesize

                    64KB

                  • memory/2116-8-0x0000000006530000-0x00000000065A8000-memory.dmp

                    Filesize

                    480KB

                  • memory/2116-0-0x0000000000840000-0x00000000008EA000-memory.dmp

                    Filesize

                    680KB

                  • memory/2788-67-0x0000000007E80000-0x00000000084FA000-memory.dmp

                    Filesize

                    6.5MB

                  • memory/2788-17-0x00000000055E0000-0x0000000005C08000-memory.dmp

                    Filesize

                    6.2MB

                  • memory/2788-16-0x0000000002C00000-0x0000000002C10000-memory.dmp

                    Filesize

                    64KB

                  • memory/2788-19-0x0000000005530000-0x0000000005552000-memory.dmp

                    Filesize

                    136KB

                  • memory/2788-20-0x0000000005E00000-0x0000000005E66000-memory.dmp

                    Filesize

                    408KB

                  • memory/2788-73-0x0000000007A70000-0x0000000007A84000-memory.dmp

                    Filesize

                    80KB

                  • memory/2788-27-0x0000000005EE0000-0x0000000006234000-memory.dmp

                    Filesize

                    3.3MB

                  • memory/2788-21-0x0000000005E70000-0x0000000005ED6000-memory.dmp

                    Filesize

                    408KB

                  • memory/2788-70-0x0000000007AB0000-0x0000000007B46000-memory.dmp

                    Filesize

                    600KB

                  • memory/2788-43-0x00000000069B0000-0x00000000069FC000-memory.dmp

                    Filesize

                    304KB

                  • memory/2788-46-0x0000000075460000-0x00000000754AC000-memory.dmp

                    Filesize

                    304KB

                  • memory/2788-66-0x0000000007740000-0x00000000077E3000-memory.dmp

                    Filesize

                    652KB

                  • memory/4340-65-0x0000000007760000-0x000000000777E000-memory.dmp

                    Filesize

                    120KB

                  • memory/4340-44-0x0000000007720000-0x0000000007752000-memory.dmp

                    Filesize

                    200KB

                  • memory/4340-45-0x0000000075460000-0x00000000754AC000-memory.dmp

                    Filesize

                    304KB

                  • memory/4340-13-0x00000000051D0000-0x00000000051E0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4340-68-0x00000000078C0000-0x00000000078DA000-memory.dmp

                    Filesize

                    104KB

                  • memory/4340-69-0x0000000007930000-0x000000000793A000-memory.dmp

                    Filesize

                    40KB

                  • memory/4340-42-0x00000000065A0000-0x00000000065BE000-memory.dmp

                    Filesize

                    120KB

                  • memory/4340-71-0x0000000007AC0000-0x0000000007AD1000-memory.dmp

                    Filesize

                    68KB

                  • memory/4340-72-0x0000000007AF0000-0x0000000007AFE000-memory.dmp

                    Filesize

                    56KB

                  • memory/4340-15-0x00000000051D0000-0x00000000051E0000-memory.dmp

                    Filesize

                    64KB

                  • memory/4340-74-0x0000000007C00000-0x0000000007C1A000-memory.dmp

                    Filesize

                    104KB

                  • memory/4340-75-0x0000000007BE0000-0x0000000007BE8000-memory.dmp

                    Filesize

                    32KB

                  • memory/4340-14-0x0000000002C90000-0x0000000002CC6000-memory.dmp

                    Filesize

                    216KB