Analysis
-
max time kernel
145s -
max time network
149s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
22-01-2022 00:35
Static task
static1
Behavioral task
behavioral1
Sample
e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe
Resource
win10-en-20211208
General
-
Target
e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe
-
Size
224KB
-
MD5
07373b24d644d8d5a69836738404a555
-
SHA1
10eadfbfafe5d3b0ee9cfcca062192be56b447a1
-
SHA256
e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0
-
SHA512
9d220bed270853c1f0cde5384ece111908130f052bf7b5879c03fd129a11e1aaab5f49e5e867d141ea4bb7b72d353554a1c86a8b985bc7cf671af289a58dfae2
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/960-63-0x0000000000400000-0x0000000000456000-memory.dmp cryptone behavioral1/memory/588-64-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/664-68-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/664-69-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/664-70-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/664-79-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 664 notepad.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
notepad.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Xjzmzj = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Xjzmzj.exe" notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run notepad.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exenotepad.exedescription ioc process File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\D: notepad.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\Q: svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exedescription pid process target process PID 960 set thread context of 1124 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchost.exee4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exepid process 588 svchost.exe 1124 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exesvchost.execalc.exenotepad.exedescription pid process Token: SeDebugPrivilege 1124 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe Token: SeDebugPrivilege 588 svchost.exe Token: SeDebugPrivilege 700 calc.exe Token: SeDebugPrivilege 664 notepad.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exesvchost.exee4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exedescription pid process target process PID 960 wrote to memory of 588 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe svchost.exe PID 960 wrote to memory of 588 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe svchost.exe PID 960 wrote to memory of 588 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe svchost.exe PID 960 wrote to memory of 588 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe svchost.exe PID 960 wrote to memory of 700 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe calc.exe PID 960 wrote to memory of 700 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe calc.exe PID 960 wrote to memory of 700 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe calc.exe PID 960 wrote to memory of 700 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe calc.exe PID 960 wrote to memory of 588 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe svchost.exe PID 960 wrote to memory of 700 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe calc.exe PID 960 wrote to memory of 700 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe calc.exe PID 588 wrote to memory of 664 588 svchost.exe notepad.exe PID 588 wrote to memory of 664 588 svchost.exe notepad.exe PID 588 wrote to memory of 664 588 svchost.exe notepad.exe PID 588 wrote to memory of 664 588 svchost.exe notepad.exe PID 588 wrote to memory of 664 588 svchost.exe notepad.exe PID 960 wrote to memory of 1124 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe PID 960 wrote to memory of 1124 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe PID 960 wrote to memory of 1124 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe PID 960 wrote to memory of 1124 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe PID 960 wrote to memory of 1124 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe PID 960 wrote to memory of 1124 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe PID 960 wrote to memory of 1124 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe PID 960 wrote to memory of 1124 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe PID 960 wrote to memory of 1124 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe PID 960 wrote to memory of 1124 960 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe PID 1124 wrote to memory of 588 1124 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe svchost.exe PID 1124 wrote to memory of 588 1124 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe svchost.exe PID 1124 wrote to memory of 700 1124 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe calc.exe PID 1124 wrote to memory of 700 1124 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe calc.exe PID 1124 wrote to memory of 664 1124 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe notepad.exe PID 1124 wrote to memory of 664 1124 e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe"C:\Users\Admin\AppData\Local\Temp\e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\SysWOW64\notepad.exe"3⤵
- Deletes itself
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe"C:\Users\Admin\AppData\Local\Temp\e4c55dc882cf54a79a44eb8f4170e78dd9cc659d279419d8205382fd51724bf0.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/588-81-0x0000000000200000-0x0000000000201000-memory.dmpFilesize
4KB
-
memory/588-102-0x0000000000250000-0x000000000029E000-memory.dmpFilesize
312KB
-
memory/588-106-0x0000000000250000-0x000000000029E000-memory.dmpFilesize
312KB
-
memory/588-124-0x0000000000250000-0x000000000029E000-memory.dmpFilesize
312KB
-
memory/588-118-0x0000000000250000-0x000000000029E000-memory.dmpFilesize
312KB
-
memory/588-108-0x0000000000250000-0x000000000029E000-memory.dmpFilesize
312KB
-
memory/588-58-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/588-94-0x0000000000250000-0x000000000029E000-memory.dmpFilesize
312KB
-
memory/588-64-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/588-98-0x0000000000250000-0x000000000029E000-memory.dmpFilesize
312KB
-
memory/588-88-0x0000000000250000-0x000000000029E000-memory.dmpFilesize
312KB
-
memory/588-85-0x0000000000250000-0x000000000029E000-memory.dmpFilesize
312KB
-
memory/664-126-0x0000000000120000-0x000000000016E000-memory.dmpFilesize
312KB
-
memory/664-96-0x0000000000120000-0x000000000016E000-memory.dmpFilesize
312KB
-
memory/664-225-0x00000000744B0000-0x00000000744F4000-memory.dmpFilesize
272KB
-
memory/664-218-0x0000000000120000-0x000000000016E000-memory.dmpFilesize
312KB
-
memory/664-104-0x0000000000120000-0x000000000016E000-memory.dmpFilesize
312KB
-
memory/664-122-0x0000000000120000-0x000000000016E000-memory.dmpFilesize
312KB
-
memory/664-128-0x0000000000120000-0x000000000016E000-memory.dmpFilesize
312KB
-
memory/664-116-0x0000000000120000-0x000000000016E000-memory.dmpFilesize
312KB
-
memory/664-79-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/664-71-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/664-70-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/664-69-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/664-68-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/664-120-0x0000000000120000-0x000000000016E000-memory.dmpFilesize
312KB
-
memory/700-119-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-111-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-65-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/700-226-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-103-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-60-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/700-115-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-121-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-90-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-101-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-59-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/700-117-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-105-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-107-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-127-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-97-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-125-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-113-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-123-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/700-114-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/960-56-0x0000000000260000-0x0000000000279000-memory.dmpFilesize
100KB
-
memory/960-54-0x00000000751B1000-0x00000000751B3000-memory.dmpFilesize
8KB
-
memory/960-57-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/960-55-0x00000000001C0000-0x00000000001C4000-memory.dmpFilesize
16KB
-
memory/960-63-0x0000000000400000-0x0000000000456000-memory.dmpFilesize
344KB
-
memory/1124-75-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1124-76-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1124-77-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1124-74-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1124-80-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1124-72-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1124-73-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB