Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
15-04-2022 16:14
Static task
static1
Behavioral task
behavioral1
Sample
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe
Resource
win10v2004-20220414-en
General
-
Target
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe
-
Size
656KB
-
MD5
fabd1bde9dfaf4ea736727c8b84d2f3b
-
SHA1
389a3e4d6185a9857053451979dd8ba74cb04886
-
SHA256
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789
-
SHA512
2fecda06d9370b98e88c08e3c6cc0b805c66083a41081201ed9e72d3a5124e5b3bab4b8d70845d30aa612257cd16d5b5184618b803a29f93b3d5451d48dd14d9
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8 = "C:\\Users\\Admin\\AppData\\Roaming\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8.exe" iexplore.exe -
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8 = "C:\\Users\\Admin\\AppData\\Roaming\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8 = "C:\\Users\\Admin\\AppData\\Roaming\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8\\L448T7G5-O1Y7-C7N1-I6V6-R0O3C5A6G2W8.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exedescription pid process target process PID 3740 set thread context of 2244 3740 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 2244 set thread context of 2984 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exepid process 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 2984 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exeiexplore.exepid process 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 2984 iexplore.exe -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exeiexplore.exedescription pid process target process PID 3740 wrote to memory of 2244 3740 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 3740 wrote to memory of 2244 3740 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 3740 wrote to memory of 2244 3740 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 3740 wrote to memory of 2244 3740 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 3740 wrote to memory of 2244 3740 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 3740 wrote to memory of 2244 3740 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 3740 wrote to memory of 2244 3740 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe PID 2244 wrote to memory of 2984 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2244 wrote to memory of 2984 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2244 wrote to memory of 2984 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2244 wrote to memory of 2984 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2244 wrote to memory of 2984 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2244 wrote to memory of 2984 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2244 wrote to memory of 2984 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2244 wrote to memory of 2984 2244 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe iexplore.exe PID 2984 wrote to memory of 1760 2984 iexplore.exe notepad.exe PID 2984 wrote to memory of 1760 2984 iexplore.exe notepad.exe PID 2984 wrote to memory of 1760 2984 iexplore.exe notepad.exe PID 2984 wrote to memory of 1760 2984 iexplore.exe notepad.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe"C:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe"{path}"2⤵
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\14f0eb0a4e795ed18fff8c171321c06672ba84f5ba1419a56b567a6e66115789.exe3⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe4⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1760-142-0x0000000000000000-mapping.dmp
-
memory/2244-136-0x0000000000000000-mapping.dmp
-
memory/2244-137-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2244-139-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/2244-143-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/3740-130-0x00000000009E0000-0x0000000000A8A000-memory.dmpFilesize
680KB
-
memory/3740-131-0x0000000005A50000-0x0000000005FF4000-memory.dmpFilesize
5.6MB
-
memory/3740-132-0x00000000054A0000-0x0000000005532000-memory.dmpFilesize
584KB
-
memory/3740-133-0x0000000005440000-0x000000000544A000-memory.dmpFilesize
40KB
-
memory/3740-134-0x0000000006530000-0x0000000006A5C000-memory.dmpFilesize
5.2MB
-
memory/3740-135-0x0000000006C60000-0x0000000006CFC000-memory.dmpFilesize
624KB