Analysis
-
max time kernel
69s -
max time network
91s -
platform
windows10-2004_x64 -
resource
win10v2004-20220718-en -
resource tags
arch:x64arch:x86image:win10v2004-20220718-enlocale:en-usos:windows10-2004-x64system -
submitted
20-07-2022 15:00
Static task
static1
Behavioral task
behavioral1
Sample
4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe
Resource
win10v2004-20220718-en
General
-
Target
4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe
-
Size
1.4MB
-
MD5
47d64846e17e347e63fc491f63108ea6
-
SHA1
dda5e7983996bca729c986bd3210def22543ca34
-
SHA256
4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682
-
SHA512
5ed0ac753d3d74c7db5d800ed098ec756a0685bbd69e204238af8d7eae835601b36b65d0e0c028de9acb1919eaf32165e4d85536bc93285d8b03d4cc1ce18e05
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
svhost.exepid Process 3868 svhost.exe -
Drops desktop.ini file(s) 2 IoCs
Processes:
4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exedescription ioc Process File created C:\Windows\assembly\Desktop.ini 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe File opened for modification C:\Windows\assembly\Desktop.ini 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exedescription pid Process procid_target PID 404 set thread context of 3868 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 79 -
Drops file in Windows directory 3 IoCs
Processes:
4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exedescription ioc Process File opened for modification C:\Windows\assembly 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe File created C:\Windows\assembly\Desktop.ini 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe File opened for modification C:\Windows\assembly\Desktop.ini 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exepid Process 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exedescription pid Process Token: SeDebugPrivilege 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exedescription pid Process procid_target PID 404 wrote to memory of 3868 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 79 PID 404 wrote to memory of 3868 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 79 PID 404 wrote to memory of 3868 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 79 PID 404 wrote to memory of 3868 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 79 PID 404 wrote to memory of 3868 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 79 PID 404 wrote to memory of 3868 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 79 PID 404 wrote to memory of 3868 404 4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe 79
Processes
-
C:\Users\Admin\AppData\Local\Temp\4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe"C:\Users\Admin\AppData\Local\Temp\4f3e3af0f516b1ae42a30ec6e4a57358a9d7da66a13f87e231fda42e2cb50682.exe"1⤵
- Drops desktop.ini file(s)
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:404 -
C:\Users\Admin\AppData\Local\Temp\svhost.exe"C:\Users\Admin\AppData\Local\Temp\svhost.exe"2⤵
- Executes dropped EXE
PID:3868
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.6MB
MD51c9ff7df71493896054a91bee0322ebf
SHA138f1c85965d58b910d8e8381b6b1099d5dfcbfe4
SHA256e8b5da3394bbdd7868122ffd88d9d06afe31bd69d656857910d2f820c32d0efa
SHA512aa0def62b663743e6c3c022182b35cff33cb9abf08453d5098f3c5d32b2a8b0cd1cc5de64b93e39680c1d1396fef1fd50b642ca3ea4ba1f6d1078321d96916ab