Analysis
-
max time kernel
11s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
07-07-2022 00:16
Static task
static1
Behavioral task
behavioral1
Sample
3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe
Resource
win10v2004-20220414-en
General
-
Target
3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe
-
Size
502KB
-
MD5
3b2dacf1e426d7e1952b3aa69bf53169
-
SHA1
a36f9333a558a23f471bc621a2636d300bd58863
-
SHA256
3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2
-
SHA512
ae15e5d12754325cc1482ba16b18153d4abc3a6f137010b34c3a1e4dbf9847891e8cf7a377265697081ad986ebb387ff0a3d3f10c480ceb5cd2823ed16d2e065
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
Processes:
HCfm323description ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,,C:\\Users\\Admin\\AppData\\Local\\xdlqdnjj\\gjddnqpa.exe" HCfm323 Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\xdlqdnjj\\gjddnqpa.exe" HCfm323 -
Modifies firewall policy service 2 TTPs 3 IoCs
Processes:
HCfm323description ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" HCfm323 Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" HCfm323 Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" HCfm323 -
Modifies security service 2 TTPs 4 IoCs
Processes:
HCfm323description ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" HCfm323 Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" HCfm323 Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" HCfm323 Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wuauserv\Start = "4" HCfm323 -
Processes:
HCfm323description ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HCfm323 -
Processes:
HCfm323description ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" HCfm323 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" HCfm323 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" HCfm323 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" HCfm323 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" HCfm323 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" HCfm323 -
Executes dropped EXE 1 IoCs
Processes:
HCfm323pid process 1756 HCfm323 -
Processes:
resource yara_rule behavioral1/memory/1756-61-0x0000000015190000-0x00000000151D3000-memory.dmp upx behavioral1/memory/1756-64-0x0000000015190000-0x00000000151D3000-memory.dmp upx -
Drops startup file 2 IoCs
Processes:
HCfm323description ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gjddnqpa.exe HCfm323 File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\gjddnqpa.exe HCfm323 -
Loads dropped DLL 1 IoCs
Processes:
3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exepid process 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe -
Processes:
HCfm323description ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" HCfm323 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" HCfm323 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" HCfm323 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" HCfm323 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" HCfm323 Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UacDisableNotify = "1" HCfm323 -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
HCfm323description ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1819626980-2277161760-1023733287-1000\Software\Microsoft\Windows\CurrentVersion\Run\GjdDnqpa = "C:\\Users\\Admin\\AppData\\Local\\xdlqdnjj\\gjddnqpa.exe" HCfm323 -
Processes:
HCfm323description ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HCfm323 -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
HCfm323pid process 1756 HCfm323 1756 HCfm323 -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
Processes:
HCfm3233c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exepid process 1756 HCfm323 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
HCfm3233c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exedescription pid process Token: SeSecurityPrivilege 1756 HCfm323 Token: SeSecurityPrivilege 1756 HCfm323 Token: SeSecurityPrivilege 1756 HCfm323 Token: SeSecurityPrivilege 1756 HCfm323 Token: SeSecurityPrivilege 1756 HCfm323 Token: SeSecurityPrivilege 1756 HCfm323 Token: SeSecurityPrivilege 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe Token: SeSecurityPrivilege 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe Token: SeSecurityPrivilege 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe Token: SeSecurityPrivilege 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe Token: SeSecurityPrivilege 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe Token: SeSecurityPrivilege 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe Token: SeSecurityPrivilege 1756 HCfm323 Token: SeRestorePrivilege 1756 HCfm323 Token: SeBackupPrivilege 1756 HCfm323 Token: SeShutdownPrivilege 1756 HCfm323 -
Suspicious use of SetWindowsHookAW 64 IoCs
Processes:
3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exepid process 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exedescription pid process target process PID 960 wrote to memory of 1756 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe HCfm323 PID 960 wrote to memory of 1756 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe HCfm323 PID 960 wrote to memory of 1756 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe HCfm323 PID 960 wrote to memory of 1756 960 3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe HCfm323 -
System policy modification 1 TTPs 1 IoCs
Processes:
HCfm323description ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" HCfm323
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe"C:\Users\Admin\AppData\Local\Temp\3c85555cebd88d75fd1f1eb19248d760b329e90bba73a9df5a438c0180a3f0b2.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookAW
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\HCfm323"HCfm323"2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Modifies security service
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\HCfm323Filesize
250KB
MD56eb541712dc7b736de250c89a915410f
SHA1a7d63500e18c5f8778254702d6ba553543b0f0ff
SHA256021656184a9194bb020725b3b6115c5f4cd320e96375e08222db5c5317a9a187
SHA5125d137be5405d2d0abd138ac0628d70a3dec4cec9a951f5fcd416d93a232b628841fc06ef34f2ad2884016b4300a148a5e311d062e012d3544ff6a6a36e5e2de7
-
C:\Users\Admin\AppData\Local\Temp\HCfm323Filesize
250KB
MD56eb541712dc7b736de250c89a915410f
SHA1a7d63500e18c5f8778254702d6ba553543b0f0ff
SHA256021656184a9194bb020725b3b6115c5f4cd320e96375e08222db5c5317a9a187
SHA5125d137be5405d2d0abd138ac0628d70a3dec4cec9a951f5fcd416d93a232b628841fc06ef34f2ad2884016b4300a148a5e311d062e012d3544ff6a6a36e5e2de7
-
\Users\Admin\AppData\Local\Temp\HCfm323Filesize
250KB
MD56eb541712dc7b736de250c89a915410f
SHA1a7d63500e18c5f8778254702d6ba553543b0f0ff
SHA256021656184a9194bb020725b3b6115c5f4cd320e96375e08222db5c5317a9a187
SHA5125d137be5405d2d0abd138ac0628d70a3dec4cec9a951f5fcd416d93a232b628841fc06ef34f2ad2884016b4300a148a5e311d062e012d3544ff6a6a36e5e2de7
-
memory/960-54-0x0000000076571000-0x0000000076573000-memory.dmpFilesize
8KB
-
memory/960-60-0x00000000025A0000-0x00000000025C1000-memory.dmpFilesize
132KB
-
memory/1756-56-0x0000000000000000-mapping.dmp
-
memory/1756-59-0x0000000001FC0000-0x0000000001FE1000-memory.dmpFilesize
132KB
-
memory/1756-61-0x0000000015190000-0x00000000151D3000-memory.dmpFilesize
268KB
-
memory/1756-64-0x0000000015190000-0x00000000151D3000-memory.dmpFilesize
268KB