Analysis
-
max time kernel
166s -
max time network
172s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-04-2022 15:52
Static task
static1
Behavioral task
behavioral1
Sample
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe
Resource
win10v2004-20220414-en
General
-
Target
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe
-
Size
1014KB
-
MD5
66b911f4bd33b3c563164c85b59f2e18
-
SHA1
0ce658b5bdf3ccfa3140df8b9d2beb1562331ed1
-
SHA256
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8
-
SHA512
050f19ec427b97850692e5ddd7f4076724e9e74c8b157e41257d00e867b1cebbf6faf5db7a2b7998a9c0bf89d13e891912d92c961c20024368debbbe07a0e0bc
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8 = "C:\\Users\\Admin\\AppData\\Roaming\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8.exe" iexplore.exe -
Processes:
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-3751123196-3323558407-1869646069-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8 = "C:\\Users\\Admin\\AppData\\Roaming\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8 = "C:\\Users\\Admin\\AppData\\Roaming\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8.exe" iexplore.exe -
Processes:
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exedescription pid process target process PID 1328 set thread context of 1568 1328 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe PID 1568 set thread context of 2844 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exepid process 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exeiexplore.exedescription pid process Token: SeDebugPrivilege 1328 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe Token: SeDebugPrivilege 2844 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exeiexplore.exepid process 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 2844 iexplore.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exeiexplore.exedescription pid process target process PID 1328 wrote to memory of 1568 1328 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe PID 1328 wrote to memory of 1568 1328 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe PID 1328 wrote to memory of 1568 1328 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe PID 1328 wrote to memory of 1568 1328 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe PID 1328 wrote to memory of 1568 1328 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe PID 1328 wrote to memory of 1568 1328 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe PID 1328 wrote to memory of 1568 1328 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe PID 1568 wrote to memory of 2844 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe iexplore.exe PID 1568 wrote to memory of 2844 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe iexplore.exe PID 1568 wrote to memory of 2844 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe iexplore.exe PID 1568 wrote to memory of 2844 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe iexplore.exe PID 1568 wrote to memory of 2844 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe iexplore.exe PID 1568 wrote to memory of 2844 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe iexplore.exe PID 1568 wrote to memory of 2844 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe iexplore.exe PID 1568 wrote to memory of 2844 1568 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe iexplore.exe PID 2844 wrote to memory of 2840 2844 iexplore.exe notepad.exe PID 2844 wrote to memory of 2840 2844 iexplore.exe notepad.exe PID 2844 wrote to memory of 2840 2844 iexplore.exe notepad.exe PID 2844 wrote to memory of 2840 2844 iexplore.exe notepad.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe"C:\Users\Admin\AppData\Local\Temp\986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe"C:\Users\Admin\AppData\Local\Temp\986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\986d993fb900f333814a9405bc8be12685aecfc2c5c0da6dc968e06f6bf4b7f8.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1328-130-0x0000000000380000-0x0000000000482000-memory.dmpFilesize
1.0MB
-
memory/1328-131-0x0000000005380000-0x0000000005924000-memory.dmpFilesize
5.6MB
-
memory/1328-132-0x0000000004E70000-0x0000000004F02000-memory.dmpFilesize
584KB
-
memory/1328-133-0x0000000004E40000-0x0000000004E4A000-memory.dmpFilesize
40KB
-
memory/1328-134-0x0000000004DD0000-0x0000000005374000-memory.dmpFilesize
5.6MB
-
memory/1328-135-0x00000000088A0000-0x0000000008906000-memory.dmpFilesize
408KB
-
memory/1568-136-0x0000000000000000-mapping.dmp
-
memory/1568-137-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1568-139-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/1568-143-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2840-142-0x0000000000000000-mapping.dmp