Analysis
- max time kernel
132s - max time network
111s - platform
windows7_x64 - resource
win7v20210410 - submitted
13/08/2021, 16:22
Static task
static1
Behavioral task
behavioral1
Sample
84b5f339ee516b5a673b00b04485fe5d.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
84b5f339ee516b5a673b00b04485fe5d.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
- Target 84b5f339ee516b5a673b00b04485fe5d.exe
- Size 35KB
- Sample210813-vxep3grane
- SHA256 694c513735b327961745d7e6da7f10c982b532fa4ce3f52b817dfdd2d7ec2e21
- MD5 84b5f339ee516b5a673b00b04485fe5d
- SHA1 fcf3ff931f62db6ff2ccd02344451c8b49ee3ebd
- SHA512 227f420b3b49823c82b84e0647cc7a6e537579d1c420fe907a14efa58c75eacaeed6077834d86dcbb217fd64a2e4dd2545da49802c5356e5faa7725e71881873
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\CMEHKbfwh\\WLScdAyDE.exe" 84b5f339ee516b5a673b00b04485fe5d.exe - Modifies Installed Components in the registry 2 TTPs
- Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 7 ipinfo.io - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1104 set thread context of 1976 1104 84b5f339ee516b5a673b00b04485fe5d.exe 27 - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeDebugPrivilege 1976 cvtres.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe - Suspicious use of SendNotifyMessage 25 IoCs
pid Process 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1104 wrote to memory of 1984 1104 84b5f339ee516b5a673b00b04485fe5d.exe 26 PID 1104 wrote to memory of 1984 1104 84b5f339ee516b5a673b00b04485fe5d.exe 26 PID 1104 wrote to memory of 1984 1104 84b5f339ee516b5a673b00b04485fe5d.exe 26 PID 1104 wrote to memory of 1984 1104 84b5f339ee516b5a673b00b04485fe5d.exe 26 PID 1104 wrote to memory of 1976 1104 84b5f339ee516b5a673b00b04485fe5d.exe 27 PID 1104 wrote to memory of 1976 1104 84b5f339ee516b5a673b00b04485fe5d.exe 27 PID 1104 wrote to memory of 1976 1104 84b5f339ee516b5a673b00b04485fe5d.exe 27 PID 1104 wrote to memory of 1976 1104 84b5f339ee516b5a673b00b04485fe5d.exe 27 PID 1104 wrote to memory of 1976 1104 84b5f339ee516b5a673b00b04485fe5d.exe 27 PID 1104 wrote to memory of 1976 1104 84b5f339ee516b5a673b00b04485fe5d.exe 27 PID 1104 wrote to memory of 1976 1104 84b5f339ee516b5a673b00b04485fe5d.exe 27 PID 1104 wrote to memory of 1976 1104 84b5f339ee516b5a673b00b04485fe5d.exe 27 PID 1104 wrote to memory of 1976 1104 84b5f339ee516b5a673b00b04485fe5d.exe 27 PID 1984 wrote to memory of 1792 1984 explorer.exe 29 PID 1984 wrote to memory of 1792 1984 explorer.exe 29 PID 1984 wrote to memory of 1792 1984 explorer.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\84b5f339ee516b5a673b00b04485fe5d.exe"C:\Users\Admin\AppData\Local\Temp\84b5f339ee516b5a673b00b04485fe5d.exe"1⤵
- Modifies WinLogon for persistence
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1104 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1984 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:1792
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" Default 45.153.241.244 5506 PTUelvuHS2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1976
-