Analysis
-
max time kernel
144s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
13-10-2021 17:53
Static task
static1
Behavioral task
behavioral1
Sample
04162b1bcb2ebb326fc52801821e42b0.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
04162b1bcb2ebb326fc52801821e42b0.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
04162b1bcb2ebb326fc52801821e42b0.exe
-
Size
12KB
-
MD5
04162b1bcb2ebb326fc52801821e42b0
-
SHA1
2443aac454b8299bdfea13017cc2339d605dacea
-
SHA256
259dbea8ad36ca1f502f7eba9257bf7111313f4ef76c34922cd34dd5808b5181
-
SHA512
701f55f4da2fddcf42ee9c0be5539a4f4e617b8a837ed88647295b1f98cf407ae52df19557c8202c303714301c6cccefd0acad49da4c138aa2d140c1d41e6973
Score
10/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 2292 notepad.exe -
Processes:
04162b1bcb2ebb326fc52801821e42b0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 04162b1bcb2ebb326fc52801821e42b0.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0 = "C:\\Users\\Admin\\AppData\\Roaming\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0\\L3Q7J4T2-J8A6-L6O4-W4G3-U5J7D0W2W5F0.exe" iexplore.exe -
Processes:
04162b1bcb2ebb326fc52801821e42b0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04162b1bcb2ebb326fc52801821e42b0.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
04162b1bcb2ebb326fc52801821e42b0.exe04162b1bcb2ebb326fc52801821e42b0.exedescription pid process target process PID 776 set thread context of 3996 776 04162b1bcb2ebb326fc52801821e42b0.exe 04162b1bcb2ebb326fc52801821e42b0.exe PID 3996 set thread context of 2308 3996 04162b1bcb2ebb326fc52801821e42b0.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
Processes:
04162b1bcb2ebb326fc52801821e42b0.exe04162b1bcb2ebb326fc52801821e42b0.exepid process 776 04162b1bcb2ebb326fc52801821e42b0.exe 776 04162b1bcb2ebb326fc52801821e42b0.exe 776 04162b1bcb2ebb326fc52801821e42b0.exe 3996 04162b1bcb2ebb326fc52801821e42b0.exe 3996 04162b1bcb2ebb326fc52801821e42b0.exe 3996 04162b1bcb2ebb326fc52801821e42b0.exe 3996 04162b1bcb2ebb326fc52801821e42b0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
04162b1bcb2ebb326fc52801821e42b0.exeiexplore.exedescription pid process Token: SeDebugPrivilege 776 04162b1bcb2ebb326fc52801821e42b0.exe Token: SeDebugPrivilege 2308 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
04162b1bcb2ebb326fc52801821e42b0.exeiexplore.exepid process 3996 04162b1bcb2ebb326fc52801821e42b0.exe 2308 iexplore.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
04162b1bcb2ebb326fc52801821e42b0.exe04162b1bcb2ebb326fc52801821e42b0.exeiexplore.exedescription pid process target process PID 776 wrote to memory of 3996 776 04162b1bcb2ebb326fc52801821e42b0.exe 04162b1bcb2ebb326fc52801821e42b0.exe PID 776 wrote to memory of 3996 776 04162b1bcb2ebb326fc52801821e42b0.exe 04162b1bcb2ebb326fc52801821e42b0.exe PID 776 wrote to memory of 3996 776 04162b1bcb2ebb326fc52801821e42b0.exe 04162b1bcb2ebb326fc52801821e42b0.exe PID 776 wrote to memory of 3996 776 04162b1bcb2ebb326fc52801821e42b0.exe 04162b1bcb2ebb326fc52801821e42b0.exe PID 776 wrote to memory of 3996 776 04162b1bcb2ebb326fc52801821e42b0.exe 04162b1bcb2ebb326fc52801821e42b0.exe PID 776 wrote to memory of 3996 776 04162b1bcb2ebb326fc52801821e42b0.exe 04162b1bcb2ebb326fc52801821e42b0.exe PID 776 wrote to memory of 3996 776 04162b1bcb2ebb326fc52801821e42b0.exe 04162b1bcb2ebb326fc52801821e42b0.exe PID 3996 wrote to memory of 2308 3996 04162b1bcb2ebb326fc52801821e42b0.exe iexplore.exe PID 3996 wrote to memory of 2308 3996 04162b1bcb2ebb326fc52801821e42b0.exe iexplore.exe PID 3996 wrote to memory of 2308 3996 04162b1bcb2ebb326fc52801821e42b0.exe iexplore.exe PID 3996 wrote to memory of 2308 3996 04162b1bcb2ebb326fc52801821e42b0.exe iexplore.exe PID 3996 wrote to memory of 2308 3996 04162b1bcb2ebb326fc52801821e42b0.exe iexplore.exe PID 3996 wrote to memory of 2308 3996 04162b1bcb2ebb326fc52801821e42b0.exe iexplore.exe PID 3996 wrote to memory of 2308 3996 04162b1bcb2ebb326fc52801821e42b0.exe iexplore.exe PID 3996 wrote to memory of 2308 3996 04162b1bcb2ebb326fc52801821e42b0.exe iexplore.exe PID 2308 wrote to memory of 2292 2308 iexplore.exe notepad.exe PID 2308 wrote to memory of 2292 2308 iexplore.exe notepad.exe PID 2308 wrote to memory of 2292 2308 iexplore.exe notepad.exe PID 2308 wrote to memory of 2292 2308 iexplore.exe notepad.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
04162b1bcb2ebb326fc52801821e42b0.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 04162b1bcb2ebb326fc52801821e42b0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\04162b1bcb2ebb326fc52801821e42b0.exe"C:\Users\Admin\AppData\Local\Temp\04162b1bcb2ebb326fc52801821e42b0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\04162b1bcb2ebb326fc52801821e42b0.exeC:\Users\Admin\AppData\Local\Temp\04162b1bcb2ebb326fc52801821e42b0.exe2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\04162b1bcb2ebb326fc52801821e42b0.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/776-114-0x00000000007B0000-0x00000000007B1000-memory.dmpFilesize
4KB
-
memory/776-116-0x00000000052C0000-0x00000000052C1000-memory.dmpFilesize
4KB
-
memory/776-117-0x0000000005ED0000-0x0000000005F6F000-memory.dmpFilesize
636KB
-
memory/776-118-0x00000000061E0000-0x0000000006210000-memory.dmpFilesize
192KB
-
memory/2292-125-0x0000000000000000-mapping.dmp
-
memory/2308-124-0x0000000000401364-mapping.dmp
-
memory/3996-119-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3996-120-0x00000000004010B8-mapping.dmp
-
memory/3996-121-0x0000000002990000-0x0000000002996000-memory.dmpFilesize
24KB
-
memory/3996-122-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3996-123-0x0000000002990000-0x000000000299A000-memory.dmpFilesize
40KB