Analysis
-
max time kernel
149s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
01-07-2022 05:28
Static task
static1
Behavioral task
behavioral1
Sample
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe
Resource
win7-20220414-en
General
-
Target
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe
-
Size
620KB
-
MD5
9d61337a7076d907d0a5282003adf16c
-
SHA1
62a7d89391337e8e52d65efa4d2456e7d28a2cdf
-
SHA256
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d
-
SHA512
674df81e9201dc39d215b1991fda1c9b41cc04a0fb4be307611d3637089e0fe49bceefe9a402ee9155e313a985359eadb461da9f86327773bbf8b0d66cc68f80
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ARP Service = "C:\\Program Files (x86)\\ARP Service\\arpsvc.exe" ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription pid process target process PID 336 set thread context of 952 336 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Drops file in Program Files directory 2 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription ioc process File created C:\Program Files (x86)\ARP Service\arpsvc.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe File opened for modification C:\Program Files (x86)\ARP Service\arpsvc.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1352 schtasks.exe 1236 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exepid process 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exepid process 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription pid process Token: SeDebugPrivilege 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exepid process 336 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exepid process 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exeff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription pid process target process PID 336 wrote to memory of 952 336 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe PID 336 wrote to memory of 952 336 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe PID 336 wrote to memory of 952 336 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe PID 336 wrote to memory of 952 336 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe PID 952 wrote to memory of 1236 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 952 wrote to memory of 1236 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 952 wrote to memory of 1236 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 952 wrote to memory of 1236 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 952 wrote to memory of 1352 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 952 wrote to memory of 1352 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 952 wrote to memory of 1352 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 952 wrote to memory of 1352 952 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe"C:\Users\Admin\AppData\Local\Temp\ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exeC:\Users\Admin\AppData\Local\Temp\ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp63B3.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "ARP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp958D.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp63B3.tmpFilesize
1KB
MD5074ac67209d1fbaf78e7690cc1da55d9
SHA15726985e8fc4ca059050416fcc5c9ebec1e9d90a
SHA256b32ba0b8821eef5b57298296c8c8bdf394fb6ec238057c22fa07b10f877862bf
SHA512cd50dd0efda9af57aaf4ea6c86afd863054367a3a265f36a5cbfc8427da3c684c725e999f632f2b98060c85c07e289c81759fddac99d23ecd92c8f832c135a5e
-
C:\Users\Admin\AppData\Local\Temp\tmp958D.tmpFilesize
1KB
MD51badb6e2b29a1c4bfff3c179d53ab96b
SHA14b2ad3e5f3826d252d1c8bf1c8f0702f39129fa1
SHA2566259ac4e6859a1b528d77ccea12b378f7dfa1eff359d9b8899414b4b1c484699
SHA51236338e2a74fd85c5f2c84be009981a7260692c1bcb121a42018209031082da69bf65640702d53e28b54871f9d44e65fdbebaf4771c530699c3e93981b58129b4
-
memory/336-56-0x0000000000240000-0x0000000000247000-memory.dmpFilesize
28KB
-
memory/336-57-0x0000000075711000-0x0000000075713000-memory.dmpFilesize
8KB
-
memory/336-59-0x0000000000240000-0x0000000000247000-memory.dmpFilesize
28KB
-
memory/336-60-0x0000000076E60000-0x0000000077009000-memory.dmpFilesize
1.7MB
-
memory/336-61-0x0000000077040000-0x00000000771C0000-memory.dmpFilesize
1.5MB
-
memory/952-65-0x0000000008AD0000-0x00000000095C8000-memory.dmpFilesize
11.0MB
-
memory/952-64-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/952-66-0x0000000076E60000-0x0000000077009000-memory.dmpFilesize
1.7MB
-
memory/952-67-0x0000000077040000-0x00000000771C0000-memory.dmpFilesize
1.5MB
-
memory/952-69-0x0000000073FD0000-0x000000007457B000-memory.dmpFilesize
5.7MB
-
memory/952-68-0x00000000095D0000-0x0000000009758000-memory.dmpFilesize
1.5MB
-
memory/952-63-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/952-72-0x0000000000220000-0x0000000000227000-memory.dmpFilesize
28KB
-
memory/952-74-0x0000000073FD0000-0x000000007457B000-memory.dmpFilesize
5.7MB
-
memory/952-58-0x0000000000486A97-mapping.dmp
-
memory/1236-70-0x0000000000000000-mapping.dmp
-
memory/1352-73-0x0000000000000000-mapping.dmp