Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
26-02-2022 06:39
Static task
static1
Behavioral task
behavioral1
Sample
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe
Resource
win10v2004-en-20220113
General
-
Target
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe
-
Size
481KB
-
MD5
3f1995ce0816d156a2c4d6ae7bc81c5c
-
SHA1
0cded80956ed98fff2487cad4d36a24e2f45b41e
-
SHA256
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2
-
SHA512
5a39c6d5298577e71c840ca4fc7b32f0dbe145d9b7023fbe8009006f0b5323c2da2ed9d45e1e3a1108b0a13cc1929ed7b0b91ce2403ac9dadd9297cafd0124b4
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\T4Y8Q5C3-R0I7-T7W6-M224-N7U6O4W0K7K6 = "C:\\Users\\Admin\\AppData\\Roaming\\T4Y8Q5C3-R0I7-T7W6-M224-N7U6O4W0K7K6\\T4Y8Q5C3-R0I7-T7W6-M224-N7U6O4W0K7K6.exe" iexplore.exe -
Processes:
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\T4Y8Q5C3-R0I7-T7W6-M224-N7U6O4W0K7K6 = "C:\\Users\\Admin\\AppData\\Roaming\\T4Y8Q5C3-R0I7-T7W6-M224-N7U6O4W0K7K6\\T4Y8Q5C3-R0I7-T7W6-M224-N7U6O4W0K7K6.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-2329389628-4064185017-3901522362-1000\Software\Microsoft\Windows\CurrentVersion\Run\T4Y8Q5C3-R0I7-T7W6-M224-N7U6O4W0K7K6 = "C:\\Users\\Admin\\AppData\\Roaming\\T4Y8Q5C3-R0I7-T7W6-M224-N7U6O4W0K7K6\\T4Y8Q5C3-R0I7-T7W6-M224-N7U6O4W0K7K6.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
Processes:
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exec50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exedescription pid process target process PID 1480 set thread context of 588 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe PID 588 set thread context of 840 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exec50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exepid process 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exeiexplore.exedescription pid process Token: SeDebugPrivilege 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe Token: SeDebugPrivilege 840 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exeiexplore.exepid process 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe 840 iexplore.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exec50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exedescription pid process target process PID 1480 wrote to memory of 588 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe PID 1480 wrote to memory of 588 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe PID 1480 wrote to memory of 588 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe PID 1480 wrote to memory of 588 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe PID 1480 wrote to memory of 588 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe PID 1480 wrote to memory of 588 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe PID 1480 wrote to memory of 588 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe PID 1480 wrote to memory of 588 1480 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe PID 588 wrote to memory of 840 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe iexplore.exe PID 588 wrote to memory of 840 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe iexplore.exe PID 588 wrote to memory of 840 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe iexplore.exe PID 588 wrote to memory of 840 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe iexplore.exe PID 588 wrote to memory of 840 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe iexplore.exe PID 588 wrote to memory of 840 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe iexplore.exe PID 588 wrote to memory of 840 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe iexplore.exe PID 588 wrote to memory of 840 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe iexplore.exe PID 588 wrote to memory of 840 588 c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe iexplore.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe"C:\Users\Admin\AppData\Local\Temp\c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe"C:\Users\Admin\AppData\Local\Temp\c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:588 -
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\c50b0ff9f14df91b2d6a6f0f0a807d5f331a926b5f350ebec89814caf10efbc2.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:840
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/588-61-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/588-62-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/588-63-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/588-64-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/588-67-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1480-54-0x000000007402E000-0x000000007402F000-memory.dmpFilesize
4KB
-
memory/1480-55-0x0000000000CF0000-0x0000000000D6E000-memory.dmpFilesize
504KB
-
memory/1480-56-0x0000000004A90000-0x0000000004A91000-memory.dmpFilesize
4KB
-
memory/1480-57-0x0000000000240000-0x0000000000252000-memory.dmpFilesize
72KB
-
memory/1480-58-0x0000000000410000-0x0000000000452000-memory.dmpFilesize
264KB
-
memory/1480-59-0x0000000000450000-0x000000000045C000-memory.dmpFilesize
48KB
-
memory/1480-60-0x00000000005F0000-0x00000000005F8000-memory.dmpFilesize
32KB