Analysis
-
max time kernel
150s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
18-06-2022 17:29
Behavioral task
behavioral1
Sample
deneee.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
General
-
Target
deneee.exe
-
Size
658KB
-
MD5
6663d3f6afcb01729e9fb7e9e245c1ee
-
SHA1
1b7be88046e58cdbb664dfbbfd52727ce3d5d395
-
SHA256
9434bc83bcf91eea11ec4994e62bf69d123a43106013f3e67ec1e67382fac0ae
-
SHA512
6859a85eb5fd913dd682ec97df13ebcd9c881037509233adccfe78b7c9b8219ac70575c82f6eb4a65ac5667eeb7dee29a6964dc4d1baa685d40cbac75391a58a
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
deneee.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" deneee.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" deneee.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile deneee.exe -
Modifies security service 2 TTPs 1 IoCs
Processes:
deneee.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" deneee.exe -
Processes:
deneee.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" deneee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" deneee.exe -
Disables RegEdit via registry modification 1 IoCs
Processes:
deneee.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-2277218442-1199762539-2004043321-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" deneee.exe -
Disables Task Manager via registry modification
-
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 2000 attrib.exe 1960 attrib.exe -
Processes:
deneee.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" deneee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" deneee.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
deneee.exepid process 960 deneee.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
deneee.exedescription pid process Token: SeIncreaseQuotaPrivilege 960 deneee.exe Token: SeSecurityPrivilege 960 deneee.exe Token: SeTakeOwnershipPrivilege 960 deneee.exe Token: SeLoadDriverPrivilege 960 deneee.exe Token: SeSystemProfilePrivilege 960 deneee.exe Token: SeSystemtimePrivilege 960 deneee.exe Token: SeProfSingleProcessPrivilege 960 deneee.exe Token: SeIncBasePriorityPrivilege 960 deneee.exe Token: SeCreatePagefilePrivilege 960 deneee.exe Token: SeBackupPrivilege 960 deneee.exe Token: SeRestorePrivilege 960 deneee.exe Token: SeShutdownPrivilege 960 deneee.exe Token: SeDebugPrivilege 960 deneee.exe Token: SeSystemEnvironmentPrivilege 960 deneee.exe Token: SeChangeNotifyPrivilege 960 deneee.exe Token: SeRemoteShutdownPrivilege 960 deneee.exe Token: SeUndockPrivilege 960 deneee.exe Token: SeManageVolumePrivilege 960 deneee.exe Token: SeImpersonatePrivilege 960 deneee.exe Token: SeCreateGlobalPrivilege 960 deneee.exe Token: 33 960 deneee.exe Token: 34 960 deneee.exe Token: 35 960 deneee.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
deneee.exepid process 960 deneee.exe -
Suspicious use of WriteProcessMemory 39 IoCs
Processes:
deneee.execmd.execmd.exedescription pid process target process PID 960 wrote to memory of 1892 960 deneee.exe cmd.exe PID 960 wrote to memory of 1892 960 deneee.exe cmd.exe PID 960 wrote to memory of 1892 960 deneee.exe cmd.exe PID 960 wrote to memory of 1892 960 deneee.exe cmd.exe PID 960 wrote to memory of 996 960 deneee.exe cmd.exe PID 960 wrote to memory of 996 960 deneee.exe cmd.exe PID 960 wrote to memory of 996 960 deneee.exe cmd.exe PID 960 wrote to memory of 996 960 deneee.exe cmd.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 960 wrote to memory of 1700 960 deneee.exe notepad.exe PID 1892 wrote to memory of 2000 1892 cmd.exe attrib.exe PID 1892 wrote to memory of 2000 1892 cmd.exe attrib.exe PID 1892 wrote to memory of 2000 1892 cmd.exe attrib.exe PID 1892 wrote to memory of 2000 1892 cmd.exe attrib.exe PID 996 wrote to memory of 1960 996 cmd.exe attrib.exe PID 996 wrote to memory of 1960 996 cmd.exe attrib.exe PID 996 wrote to memory of 1960 996 cmd.exe attrib.exe PID 996 wrote to memory of 1960 996 cmd.exe attrib.exe -
System policy modification 1 TTPs 3 IoCs
Processes:
deneee.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion deneee.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern deneee.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" deneee.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 2000 attrib.exe 1960 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\deneee.exe"C:\Users\Admin\AppData\Local\Temp\deneee.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\deneee.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\deneee.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\notepad.exenotepad2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/960-54-0x0000000075801000-0x0000000075803000-memory.dmpFilesize
8KB
-
memory/996-56-0x0000000000000000-mapping.dmp
-
memory/1700-57-0x0000000000000000-mapping.dmp
-
memory/1892-55-0x0000000000000000-mapping.dmp
-
memory/1960-60-0x0000000000000000-mapping.dmp
-
memory/2000-59-0x0000000000000000-mapping.dmp