Analysis
-
max time kernel
155s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220112 -
submitted
02-03-2022 03:32
Static task
static1
Behavioral task
behavioral1
Sample
e7ab0c483542652a8ba5df01c70148b7.exe
Resource
win7-20220223-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e7ab0c483542652a8ba5df01c70148b7.exe
Resource
win10v2004-en-20220112
0 signatures
0 seconds
General
-
Target
e7ab0c483542652a8ba5df01c70148b7.exe
-
Size
655KB
-
MD5
e7ab0c483542652a8ba5df01c70148b7
-
SHA1
fdfb0d76b28f2bf0e4b946c51fa2dd0f654ec259
-
SHA256
39feefb57167dd5ed9c900fa4b18aa815b955396ea3a298a5588bd9946d6a10d
-
SHA512
d24528a0572465c51d99247076f591737f60116e8bab9a877f7e5219d76b782383921c84cea395566e44e1160efd78974441648b6e60902b98a6d7246a01f6b9
Score
10/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\P1H5Y4R2-S002-Y7M3-V0W4-F4D2N1R6S0C7 = "C:\\Users\\Admin\\AppData\\Roaming\\P1H5Y4R2-S002-Y7M3-V0W4-F4D2N1R6S0C7\\P1H5Y4R2-S002-Y7M3-V0W4-F4D2N1R6S0C7.exe" iexplore.exe -
Processes:
e7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" e7ab0c483542652a8ba5df01c70148b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" e7ab0c483542652a8ba5df01c70148b7.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-790714498-1549421491-1643397139-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\P1H5Y4R2-S002-Y7M3-V0W4-F4D2N1R6S0C7 = "C:\\Users\\Admin\\AppData\\Roaming\\P1H5Y4R2-S002-Y7M3-V0W4-F4D2N1R6S0C7\\P1H5Y4R2-S002-Y7M3-V0W4-F4D2N1R6S0C7.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\P1H5Y4R2-S002-Y7M3-V0W4-F4D2N1R6S0C7 = "C:\\Users\\Admin\\AppData\\Roaming\\P1H5Y4R2-S002-Y7M3-V0W4-F4D2N1R6S0C7\\P1H5Y4R2-S002-Y7M3-V0W4-F4D2N1R6S0C7.exe" iexplore.exe -
Processes:
e7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e7ab0c483542652a8ba5df01c70148b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e7ab0c483542652a8ba5df01c70148b7.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
e7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exedescription pid process target process PID 840 set thread context of 3384 840 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 3384 set thread context of 3992 3384 e7ab0c483542652a8ba5df01c70148b7.exe iexplore.exe PID 400 set thread context of 2740 400 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe -
Suspicious behavior: EnumeratesProcesses 12 IoCs
Processes:
e7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exepid process 840 e7ab0c483542652a8ba5df01c70148b7.exe 840 e7ab0c483542652a8ba5df01c70148b7.exe 3384 e7ab0c483542652a8ba5df01c70148b7.exe 3384 e7ab0c483542652a8ba5df01c70148b7.exe 3384 e7ab0c483542652a8ba5df01c70148b7.exe 3384 e7ab0c483542652a8ba5df01c70148b7.exe 3592 e7ab0c483542652a8ba5df01c70148b7.exe 3592 e7ab0c483542652a8ba5df01c70148b7.exe 3592 e7ab0c483542652a8ba5df01c70148b7.exe 3592 e7ab0c483542652a8ba5df01c70148b7.exe 400 e7ab0c483542652a8ba5df01c70148b7.exe 400 e7ab0c483542652a8ba5df01c70148b7.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
e7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exepid process 840 e7ab0c483542652a8ba5df01c70148b7.exe 840 e7ab0c483542652a8ba5df01c70148b7.exe 400 e7ab0c483542652a8ba5df01c70148b7.exe 400 e7ab0c483542652a8ba5df01c70148b7.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 3992 iexplore.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
e7ab0c483542652a8ba5df01c70148b7.exeiexplore.exee7ab0c483542652a8ba5df01c70148b7.exepid process 3384 e7ab0c483542652a8ba5df01c70148b7.exe 3992 iexplore.exe 2740 e7ab0c483542652a8ba5df01c70148b7.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
e7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exedescription pid process target process PID 840 wrote to memory of 3384 840 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 840 wrote to memory of 3384 840 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 840 wrote to memory of 3384 840 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 840 wrote to memory of 3592 840 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 840 wrote to memory of 3592 840 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 840 wrote to memory of 3592 840 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 3384 wrote to memory of 3992 3384 e7ab0c483542652a8ba5df01c70148b7.exe iexplore.exe PID 3384 wrote to memory of 3992 3384 e7ab0c483542652a8ba5df01c70148b7.exe iexplore.exe PID 3384 wrote to memory of 3992 3384 e7ab0c483542652a8ba5df01c70148b7.exe iexplore.exe PID 3384 wrote to memory of 3992 3384 e7ab0c483542652a8ba5df01c70148b7.exe iexplore.exe PID 3384 wrote to memory of 3992 3384 e7ab0c483542652a8ba5df01c70148b7.exe iexplore.exe PID 3384 wrote to memory of 3992 3384 e7ab0c483542652a8ba5df01c70148b7.exe iexplore.exe PID 3384 wrote to memory of 3992 3384 e7ab0c483542652a8ba5df01c70148b7.exe iexplore.exe PID 3384 wrote to memory of 3992 3384 e7ab0c483542652a8ba5df01c70148b7.exe iexplore.exe PID 3592 wrote to memory of 400 3592 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 3592 wrote to memory of 400 3592 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 3592 wrote to memory of 400 3592 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 400 wrote to memory of 2740 400 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 400 wrote to memory of 2740 400 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 400 wrote to memory of 2740 400 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 400 wrote to memory of 2464 400 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 400 wrote to memory of 2464 400 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe PID 400 wrote to memory of 2464 400 e7ab0c483542652a8ba5df01c70148b7.exe e7ab0c483542652a8ba5df01c70148b7.exe -
System policy modification 1 TTPs 2 IoCs
Processes:
e7ab0c483542652a8ba5df01c70148b7.exee7ab0c483542652a8ba5df01c70148b7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e7ab0c483542652a8ba5df01c70148b7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e7ab0c483542652a8ba5df01c70148b7.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe"C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe"C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe"C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe" 2 3384 303410152⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe"C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe"C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe"4⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetWindowsHookEx
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe"C:\Users\Admin\AppData\Local\Temp\e7ab0c483542652a8ba5df01c70148b7.exe" 2 2740 304130934⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/400-136-0x00000000020E0000-0x00000000020E1000-memory.dmpFilesize
4KB
-
memory/840-130-0x0000000002220000-0x0000000002221000-memory.dmpFilesize
4KB
-
memory/840-131-0x0000000002250000-0x0000000002251000-memory.dmpFilesize
4KB
-
memory/2464-140-0x00000000022F0000-0x00000000022F1000-memory.dmpFilesize
4KB
-
memory/2740-139-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3384-132-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3592-135-0x0000000000650000-0x0000000000651000-memory.dmpFilesize
4KB