Analysis
-
max time kernel
151s -
max time network
167s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
15-04-2022 16:14
Static task
static1
Behavioral task
behavioral1
Sample
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe
Resource
win10v2004-20220414-en
General
-
Target
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe
-
Size
656KB
-
MD5
fabd1bde9dfaf4ea736727c8b84d2f3b
-
SHA1
389a3e4d6185a9857053451979dd8ba74cb04886
-
SHA256
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789
-
SHA512
2fecda06d9370b98e88c08e3c6cc0b805c66083a41081201ed9e72d3a5124e5b3bab4b8d70845d30aa612257cd16d5b5184618b803a29f93b3d5451d48dd14d9
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8 = "C:\\Users\\Admin\\AppData\\Roaming\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8.exe" iexplore.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 268 notepad.exe -
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8 = "C:\\Users\\Admin\\AppData\\Roaming\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8 = "C:\\Users\\Admin\\AppData\\Roaming\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8.exe" iexplore.exe -
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exedescription pid process target process PID 1732 set thread context of 2040 1732 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 2040 set thread context of 432 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 set thread context of 1872 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exepid process 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 1872 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exeiexplore.exepid process 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 1872 iexplore.exe -
Suspicious use of WriteProcessMemory 31 IoCs
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exeiexplore.exedescription pid process target process PID 1732 wrote to memory of 2040 1732 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 1732 wrote to memory of 2040 1732 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 1732 wrote to memory of 2040 1732 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 1732 wrote to memory of 2040 1732 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 1732 wrote to memory of 2040 1732 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 1732 wrote to memory of 2040 1732 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 1732 wrote to memory of 2040 1732 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 1732 wrote to memory of 2040 1732 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 2040 wrote to memory of 432 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 432 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 432 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 432 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 432 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 432 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 432 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 432 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 432 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 1872 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 1872 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 1872 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 1872 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 1872 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 1872 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 1872 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 1872 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2040 wrote to memory of 1872 2040 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 1872 wrote to memory of 268 1872 iexplore.exe notepad.exe PID 1872 wrote to memory of 268 1872 iexplore.exe notepad.exe PID 1872 wrote to memory of 268 1872 iexplore.exe notepad.exe PID 1872 wrote to memory of 268 1872 iexplore.exe notepad.exe PID 1872 wrote to memory of 268 1872 iexplore.exe notepad.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe"C:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe3⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/268-69-0x0000000000000000-mapping.dmp
-
memory/268-70-0x00000000755C1000-0x00000000755C3000-memory.dmpFilesize
8KB
-
memory/1732-54-0x0000000000E10000-0x0000000000EBA000-memory.dmpFilesize
680KB
-
memory/1732-55-0x00000000005C0000-0x00000000005DC000-memory.dmpFilesize
112KB
-
memory/1732-56-0x00000000022C0000-0x000000000231C000-memory.dmpFilesize
368KB
-
memory/2040-57-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2040-60-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2040-58-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2040-62-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2040-63-0x00000000004010B8-mapping.dmp
-
memory/2040-68-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB