Analysis
- max time kernel
136s - max time network
131s - platform
windows7_x64 - resource
win7-en-20211208 - submitted
30/01/2022, 12:56
Static task
static1
Behavioral task
behavioral1
Sample
d0488c635bdf39e3670bccb70e240ef9.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d0488c635bdf39e3670bccb70e240ef9.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target d0488c635bdf39e3670bccb70e240ef9.exe
- Size 138KB
- Sample220130-p6cslsbcgl
- SHA256 8a3d555c8d1019b6d42721a2eea770d2101458fd70b208f6767db2eeb1cd44bc
- MD5 d0488c635bdf39e3670bccb70e240ef9
- SHA1 3deb0acc0a9d72202e38d1afcae265d4671489d8
- SHA512 4370af21751cceffcbcdf37e9a6f36e404fd6eaab649e3dcb52a37fc0ee11c854539e08a711975f907b1c1ff577b9b13a659dfd0d008b089c26f85501e79a94f
- SSDEEP 3072:Obvt5mz7Bqh1v59Y08mAjs0Ltel+qOeJHlpV8b+Y/YG:Obv7S7BqjjYHdrqkL/
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe - Suspicious behavior: EnumeratesProcesses 21 IoCs
pid Process 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe 1584 d0488c635bdf39e3670bccb70e240ef9.exe - Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 1584 d0488c635bdf39e3670bccb70e240ef9.exe Token: SeShutdownPrivilege 520 explorer.exe Token: SeShutdownPrivilege 520 explorer.exe Token: SeShutdownPrivilege 520 explorer.exe Token: SeShutdownPrivilege 520 explorer.exe Token: SeShutdownPrivilege 520 explorer.exe Token: SeShutdownPrivilege 520 explorer.exe Token: SeShutdownPrivilege 520 explorer.exe Token: SeShutdownPrivilege 520 explorer.exe - Suspicious use of FindShellTrayWindow 24 IoCs
pid Process 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe - Suspicious use of SendNotifyMessage 16 IoCs
pid Process 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe 520 explorer.exe - Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1584 wrote to memory of 520 1584 d0488c635bdf39e3670bccb70e240ef9.exe 27 PID 1584 wrote to memory of 520 1584 d0488c635bdf39e3670bccb70e240ef9.exe 27 PID 1584 wrote to memory of 520 1584 d0488c635bdf39e3670bccb70e240ef9.exe 27 PID 520 wrote to memory of 768 520 explorer.exe 28 PID 520 wrote to memory of 768 520 explorer.exe 28 PID 520 wrote to memory of 768 520 explorer.exe 28 PID 1584 wrote to memory of 1796 1584 d0488c635bdf39e3670bccb70e240ef9.exe 29 PID 1584 wrote to memory of 1796 1584 d0488c635bdf39e3670bccb70e240ef9.exe 29 PID 1584 wrote to memory of 1796 1584 d0488c635bdf39e3670bccb70e240ef9.exe 29 PID 1584 wrote to memory of 1796 1584 d0488c635bdf39e3670bccb70e240ef9.exe 29 PID 1584 wrote to memory of 1172 1584 d0488c635bdf39e3670bccb70e240ef9.exe 30 PID 1584 wrote to memory of 1172 1584 d0488c635bdf39e3670bccb70e240ef9.exe 30 PID 1584 wrote to memory of 1172 1584 d0488c635bdf39e3670bccb70e240ef9.exe 30 PID 1584 wrote to memory of 1172 1584 d0488c635bdf39e3670bccb70e240ef9.exe 30 PID 1584 wrote to memory of 740 1584 d0488c635bdf39e3670bccb70e240ef9.exe 31 PID 1584 wrote to memory of 740 1584 d0488c635bdf39e3670bccb70e240ef9.exe 31 PID 1584 wrote to memory of 740 1584 d0488c635bdf39e3670bccb70e240ef9.exe 31 PID 1584 wrote to memory of 740 1584 d0488c635bdf39e3670bccb70e240ef9.exe 31 PID 1584 wrote to memory of 1536 1584 d0488c635bdf39e3670bccb70e240ef9.exe 32 PID 1584 wrote to memory of 1536 1584 d0488c635bdf39e3670bccb70e240ef9.exe 32 PID 1584 wrote to memory of 1536 1584 d0488c635bdf39e3670bccb70e240ef9.exe 32 PID 1584 wrote to memory of 1536 1584 d0488c635bdf39e3670bccb70e240ef9.exe 32 PID 1584 wrote to memory of 1496 1584 d0488c635bdf39e3670bccb70e240ef9.exe 33 PID 1584 wrote to memory of 1496 1584 d0488c635bdf39e3670bccb70e240ef9.exe 33 PID 1584 wrote to memory of 1496 1584 d0488c635bdf39e3670bccb70e240ef9.exe 33 PID 1584 wrote to memory of 1496 1584 d0488c635bdf39e3670bccb70e240ef9.exe 33 PID 1584 wrote to memory of 1880 1584 d0488c635bdf39e3670bccb70e240ef9.exe 34 PID 1584 wrote to memory of 1880 1584 d0488c635bdf39e3670bccb70e240ef9.exe 34 PID 1584 wrote to memory of 1880 1584 d0488c635bdf39e3670bccb70e240ef9.exe 34 PID 1584 wrote to memory of 1880 1584 d0488c635bdf39e3670bccb70e240ef9.exe 34 PID 1584 wrote to memory of 1820 1584 d0488c635bdf39e3670bccb70e240ef9.exe 35 PID 1584 wrote to memory of 1820 1584 d0488c635bdf39e3670bccb70e240ef9.exe 35 PID 1584 wrote to memory of 1820 1584 d0488c635bdf39e3670bccb70e240ef9.exe 35 PID 1584 wrote to memory of 1820 1584 d0488c635bdf39e3670bccb70e240ef9.exe 35 PID 1584 wrote to memory of 1480 1584 d0488c635bdf39e3670bccb70e240ef9.exe 36 PID 1584 wrote to memory of 1480 1584 d0488c635bdf39e3670bccb70e240ef9.exe 36 PID 1584 wrote to memory of 1480 1584 d0488c635bdf39e3670bccb70e240ef9.exe 36 PID 1584 wrote to memory of 1480 1584 d0488c635bdf39e3670bccb70e240ef9.exe 36 PID 1584 wrote to memory of 1948 1584 d0488c635bdf39e3670bccb70e240ef9.exe 37 PID 1584 wrote to memory of 1948 1584 d0488c635bdf39e3670bccb70e240ef9.exe 37 PID 1584 wrote to memory of 1948 1584 d0488c635bdf39e3670bccb70e240ef9.exe 37 PID 1584 wrote to memory of 1948 1584 d0488c635bdf39e3670bccb70e240ef9.exe 37 PID 1584 wrote to memory of 608 1584 d0488c635bdf39e3670bccb70e240ef9.exe 38 PID 1584 wrote to memory of 608 1584 d0488c635bdf39e3670bccb70e240ef9.exe 38 PID 1584 wrote to memory of 608 1584 d0488c635bdf39e3670bccb70e240ef9.exe 38 PID 1584 wrote to memory of 608 1584 d0488c635bdf39e3670bccb70e240ef9.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\d0488c635bdf39e3670bccb70e240ef9.exe"C:\Users\Admin\AppData\Local\Temp\d0488c635bdf39e3670bccb70e240ef9.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Windows\system32\ctfmon.exectfmon.exe3⤵PID:768
-
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 21LTX5 bigrussianfloppa.duckdns.org 1338 M7SYHB2⤵PID:1796
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 21LTX5 bigrussianfloppa.duckdns.org 1338 M7SYHB2⤵PID:1172
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 21LTX5 bigrussianfloppa.duckdns.org 1338 M7SYHB2⤵PID:740
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 21LTX5 bigrussianfloppa.duckdns.org 1338 M7SYHB2⤵PID:1536
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 21LTX5 bigrussianfloppa.duckdns.org 1338 M7SYHB2⤵PID:1496
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 21LTX5 bigrussianfloppa.duckdns.org 1338 M7SYHB2⤵PID:1880
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 21LTX5 bigrussianfloppa.duckdns.org 1338 M7SYHB2⤵PID:1820
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 21LTX5 bigrussianfloppa.duckdns.org 1338 M7SYHB2⤵PID:1480
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 21LTX5 bigrussianfloppa.duckdns.org 1338 M7SYHB2⤵PID:1948
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\cvtres.exe" 21LTX5 bigrussianfloppa.duckdns.org 1338 M7SYHB2⤵PID:608
-