8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436

General

Target
8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Size 477KB
Sample260916-rl82esbc86
SHA256 8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436
MD5 492151e4d208bb5a3546887130b95afe
SHA1 4128172bdc088a1394318937d860e020b74ff949
SHA512 c4747879bc8f9c68a53b41de7b87b111175111e446648876d2f139054d07ee98ad884687ab4b4ddd0b0ce4afbbd30b7192f96ce5c5684ac2f930d593ac66c2e5
SSDEEP 6144:JF2C5NYgZgZxa1myjLKZydD5odDPCYMqqKNe3Sl:JFNNDgZxMJjLpYl/se
TLSH
T140A419222298452CF4A38534CD3BCA22E5737CD1A1B8ED2F361DB4A91F3B754A7B1B15
MD5 SHA1 SHA512 SSDEEP TLSH

Score

7^/10

persistence

Malware Config

Signatures

Checks computer location settings 2 TTPs 1 IoCs

Looks up country code configured in the registry, likely geofence.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000\Control Panel\International\Geo\Nation	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe

Power Settings 1 TTPs 1 IoCs

powercfg controls all configurable power system settings on a Windows system and can be abused to prevent an infected host from locking or shutting down.

persistence

Power Settings

T1653

pid	Process
4704	powercfg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Enumerates system info in registry 2 TTPs 12 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSReleaseDate	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVendor	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardManufacturer	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardProduct	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BaseBoardVersion	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\BIOSVersion	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\ECFirmwareMajorRelease	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemProductName	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemVersion	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command and Scripting Interpreter

T1059

pid	Process
728	ipconfig.exe

Modifies registry class 1 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-681733028-2344970462-962213935-1000_Classes\Local Settings	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeShutdownPrivilege	4704	powercfg.exe
Token: SeCreatePagefilePrivilege	4704	powercfg.exe

Suspicious use of WriteProcessMemory 3 IoCs

description	pid	Process	procid_target
PID 6020 wrote to memory of 4704	6020	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe	84
PID 6020 wrote to memory of 728	6020	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe	86
PID 6020 wrote to memory of 3360	6020	8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe	92

C:\Users\Admin\AppData\Local\Temp\8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe
"C:\Users\Admin\AppData\Local\Temp\8ac93a8200fbeb71bc0751860f45ddeb1a7c88cee0162b56f84accf37cdd5436.exe"
1⤵
- Checks computer location settings
- Enumerates system info in registry
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:6020
- C:\Windows\System32\powercfg.exe
  powercfg.exe /batteryreport /output "C:\Users\Admin\AppData\Local\Temp\battery-report.html"
  2⤵
  - Power Settings
  - Suspicious use of AdjustPrivilegeToken
  PID:4704
- C:\Windows\System32\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:728
- C:\Windows\system32\NOTEPAD.EXE
  "C:\Windows\system32\NOTEPAD.EXE" C:\Users\Admin\AppData\Local\Temp\Donation-EN.txt
  2⤵
  PID:3360

Network

MITRE ATT&CK Enterprise v16

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

1

T1059

Persistence

Power Settings

1

T1653

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

2

T1012

System Information Discovery

4

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

Donation-EN.txt

Path C:\Users\Admin\AppData\Local\Temp\Donation-EN.txt
Size 309B
SHA256 644309c9b7e3eafd1630d5fce3f336a4302034d6853cb408ede904d9d4b1bd28
MD5 0810b0efe135c66c379830cc5d793565
SHA1 8cc01e6847613f6c984b825ad164f6de56057308
SHA512 9536d4db7e8bf44af675768b5c5ece1a68f34f9127dcc5cabbfe4e250aae81b79649eb90d8a3e10a2e57ef2839b4a48c350dc6c01fac9dfc31b28efe1b769865
TLSH
T1E4E07D6F1049E28DAAA051937143D5D8F73F95F4B154205070EC40C8635850C553F31C
MD5 SHA1 SHA512 TLSH

Submit Download

Ipconfug.list.txt

Path C:\Users\Admin\AppData\Local\Temp\Ipconfug.list.txt
Size 1023B
SHA256 6159c2cef1f6c4a0b1840b7dabb36a8fb8711683ed543f070f7e50b29662a462
MD5 3e487a03f89b2431d5ad72b0c93705c1
SHA1 b359986f594124a7461cc15738ecf7b0d91f3821
SHA512 6722943560486f41af1dcdff6951faf1f0e2f07bd5ed5f1f3708c5da1bd104dfa47308d5550b55a083f145e709652503dc8d9d993412dbb21d3a7b32ae286dad
TLSH
T1D111BD580AA8F413377A4A411CA9973AE4D44E97C007E5B0BDBCB548BC332B5AF42ED3
MD5 SHA1 SHA512 TLSH

Submit Download

icon1.ico

Path C:\Users\Admin\AppData\Local\Temp\icon1.ico
Size 1KB
SHA256 76d8c6e34ff94c4c723686215799799cda05d329db6677cb2796c0812b4a36a9
MD5 4976c6dd9daf3ff2b2df58d4d79992ab
SHA1 0e40d11d3848f0e46b64981d432394986763b205
SHA512 1888ee353ed601d7c8b1ab211ab71503c48adeee1b5b5ac1646f76f3ea4ae60546894cd54528bde5f2b7c8fbbfd0f14db4a45c963f50df3d8ecaa0fff418d83e
TLSH
T1DD21D0410D186EDDC42E63365A661EC00969322F07F064CA6B6D9911588CB45043FE52
MD5 SHA1 SHA512 TLSH

Submit Download

icon2.ico

Path C:\Users\Admin\AppData\Local\Temp\icon2.ico
Size 1KB
SHA256 c0e78e78c1b80fdc2bf9cb28d3751aae0530be1d98b7afcb9eece4cd76529997
MD5 9f8080195e1ccb4cbe6141a206cf791c
SHA1 ee529e84487800bf7c4c93bde5e60020ab572cec
SHA512 68b0b0de160972a7c76b6094ecbb58c034a4bf8fa2008f4b34000b733f6a2bfdda83ed1e75693db7bdc5a4ddf9aa98174efffcdb52379d5cb4abe9a9794b0701
TLSH
T13521043E9908A0CFF92A6BBD479C9B02D00CCE547DE82B24917C388D972918656F73A5
MD5 SHA1 SHA512 TLSH

Submit Download

icon3.ico

Path C:\Users\Admin\AppData\Local\Temp\icon3.ico
Size 1KB
SHA256 8f1ed54bd12c85e6d930f761cd7d8acf68ff3fa71e94eb4902b62e1e83274130
MD5 72199e83a61db0a0db30d3cbb0a53801
SHA1 8eeb277002d6b5f3c570bbe1a2309c1849b51e88
SHA512 ec02a64dbe4a124801669e65eb84710d18819b02c36b03d6e7f7b58ea35a9fe3aa6371ee19c2f78da150913ea34c2375175d29c5b0a9d1faf1e1d8b019cd0f2e
TLSH
T1672163FDB815F55FD03C673713C62B06638ACC548C9C4E302296B6C9463407517372E6
MD5 SHA1 SHA512 TLSH

Submit Download

icon4.ico

Path C:\Users\Admin\AppData\Local\Temp\icon4.ico
Size 1KB
SHA256 f5e33aa90cc091c9ad428db38e1d5e61e5096bd9d60ab835f90f53a8be94dea3
MD5 0d4e43c749dc2254ce61ac32de93be6a
SHA1 460ae6e3e463a549d868d05815b54bbcd49ce922
SHA512 825f6e0d841de8648cb1a6f392f568dfb1bf64cc2365d898195cec8470a7f35bde66c9b19ff64b699975d62e89ea15cad0f36edf4a61fe7e327be99d35dd1563
TLSH
T10F21849C1194ED32F7C0C0F069233632E1AAB523442B1BA3F1305D173E9B0469E3BB50
MD5 SHA1 SHA512 TLSH

Submit Download

icon5.ico

Path C:\Users\Admin\AppData\Local\Temp\icon5.ico
Size 1KB
SHA256 e7cfd9428a899d097ba5a09109097677335a461a050557e4b7a511843c07c4ed
MD5 7fb73f38a78a4eeb58ad9aa0f85f4c24
SHA1 f2097fd80087a509d0b2e1fa3620d444493f4058
SHA512 6bc1002263fb1b730abbf812ca022b9a44d09c4a54770afc6f299a226c5ccd1518d22c885c30f080615678e868cddb1fe343802fbf67c7de5dc583e2ea4df283
TLSH
T1DC21105D2084607EDD6F073B06950BA326E7581B50A8614500E17B8899C31A663A7BC2
MD5 SHA1 SHA512 TLSH

Submit Download

logo.jpg

Path C:\Users\Admin\AppData\Local\Temp\logo.jpg
Size 5KB
SHA256 6437d86aaec6936b10aa37f1cf11a19f85ad5b40950e8cf1c141f452361c129b
MD5 e30f93b671d861b3dd14e8264c4f179d
SHA1 23e623f6afb13c6939569f5787197835cc0d452a
SHA512 f2e86a00a810956d82660f93a06508db955298d15cba1869f3b654ea1f8962f11892e9c17af492fee5d75343079d10d8522bcafecdba12c3c4231f60c66d15e0
SSDEEP 96:0EmwVzXhaDqsN6GEdQQAdt0hze+xjbSiFaCvMF6c86+mpXiIs1U5:0uxaD3cdQtdt0hzeqbfaQMFbHpX+U5
TLSH
T1C2C18D6B57E28DE0FDE780BF04BAC29D4B3865BB252752012B75C42037D06D74DC196E
MD5 SHA1 SHA512 SSDEEP TLSH

Submit Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v16

Replay Monitor

Loading Replay Monitor...

Downloads