Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 06:42
Behavioral task
behavioral1
Sample
58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe
Resource
win7-20220715-en
General
-
Target
58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe
-
Size
756KB
-
MD5
29576b605f9b997bbb7bb7290dc63a8b
-
SHA1
a4ece5227c704039ac4556d8b2d5832404239f93
-
SHA256
58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2
-
SHA512
c6d246ca7126a4cd6e828ba6b283c446530d513f8be5ef546fba4e13061e39dad2dfc40c408129999af23960f3a6de3250caac56920f8499d2fcd711e7272b96
Malware Config
Signatures
-
Processes:
58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exeiexplore.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe -
Disables RegEdit via registry modification 2 IoCs
Processes:
58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exeiexplore.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Set value (int) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" iexplore.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
Processes:
attrib.exeattrib.exepid process 968 attrib.exe 1840 attrib.exe -
Processes:
58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exedescription pid process target process PID 1896 set thread context of 1264 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
iexplore.exepid process 1264 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
Processes:
58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exeiexplore.exedescription pid process Token: SeIncreaseQuotaPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeSecurityPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeTakeOwnershipPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeLoadDriverPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeSystemProfilePrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeSystemtimePrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeProfSingleProcessPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeIncBasePriorityPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeCreatePagefilePrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeBackupPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeRestorePrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeShutdownPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeDebugPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeSystemEnvironmentPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeChangeNotifyPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeRemoteShutdownPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeUndockPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeManageVolumePrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeImpersonatePrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeCreateGlobalPrivilege 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: 33 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: 34 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: 35 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe Token: SeIncreaseQuotaPrivilege 1264 iexplore.exe Token: SeSecurityPrivilege 1264 iexplore.exe Token: SeTakeOwnershipPrivilege 1264 iexplore.exe Token: SeLoadDriverPrivilege 1264 iexplore.exe Token: SeSystemProfilePrivilege 1264 iexplore.exe Token: SeSystemtimePrivilege 1264 iexplore.exe Token: SeProfSingleProcessPrivilege 1264 iexplore.exe Token: SeIncBasePriorityPrivilege 1264 iexplore.exe Token: SeCreatePagefilePrivilege 1264 iexplore.exe Token: SeBackupPrivilege 1264 iexplore.exe Token: SeRestorePrivilege 1264 iexplore.exe Token: SeShutdownPrivilege 1264 iexplore.exe Token: SeDebugPrivilege 1264 iexplore.exe Token: SeSystemEnvironmentPrivilege 1264 iexplore.exe Token: SeChangeNotifyPrivilege 1264 iexplore.exe Token: SeRemoteShutdownPrivilege 1264 iexplore.exe Token: SeUndockPrivilege 1264 iexplore.exe Token: SeManageVolumePrivilege 1264 iexplore.exe Token: SeImpersonatePrivilege 1264 iexplore.exe Token: SeCreateGlobalPrivilege 1264 iexplore.exe Token: 33 1264 iexplore.exe Token: 34 1264 iexplore.exe Token: 35 1264 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
iexplore.exepid process 1264 iexplore.exe -
Suspicious use of WriteProcessMemory 45 IoCs
Processes:
58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.execmd.execmd.exeiexplore.exedescription pid process target process PID 1896 wrote to memory of 1352 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe cmd.exe PID 1896 wrote to memory of 1352 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe cmd.exe PID 1896 wrote to memory of 1352 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe cmd.exe PID 1896 wrote to memory of 1352 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe cmd.exe PID 1896 wrote to memory of 1572 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe cmd.exe PID 1896 wrote to memory of 1572 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe cmd.exe PID 1896 wrote to memory of 1572 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe cmd.exe PID 1896 wrote to memory of 1572 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe cmd.exe PID 1896 wrote to memory of 1264 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe iexplore.exe PID 1896 wrote to memory of 1264 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe iexplore.exe PID 1896 wrote to memory of 1264 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe iexplore.exe PID 1896 wrote to memory of 1264 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe iexplore.exe PID 1896 wrote to memory of 1264 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe iexplore.exe PID 1896 wrote to memory of 1264 1896 58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe iexplore.exe PID 1572 wrote to memory of 1840 1572 cmd.exe attrib.exe PID 1572 wrote to memory of 1840 1572 cmd.exe attrib.exe PID 1572 wrote to memory of 1840 1572 cmd.exe attrib.exe PID 1572 wrote to memory of 1840 1572 cmd.exe attrib.exe PID 1352 wrote to memory of 968 1352 cmd.exe attrib.exe PID 1352 wrote to memory of 968 1352 cmd.exe attrib.exe PID 1352 wrote to memory of 968 1352 cmd.exe attrib.exe PID 1352 wrote to memory of 968 1352 cmd.exe attrib.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe PID 1264 wrote to memory of 2028 1264 iexplore.exe notepad.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
Processes:
attrib.exeattrib.exepid process 968 attrib.exe 1840 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe"C:\Users\Admin\AppData\Local\Temp\58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe"1⤵
- Windows security bypass
- Disables RegEdit via registry modification
- Windows security modification
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\58bc9b0c5e16f64103d96cf3dab84488d9e44de1f17619163665bc30bf388df2.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Windows security bypass
- Disables RegEdit via registry modification
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/968-58-0x0000000000000000-mapping.dmp
-
memory/1352-55-0x0000000000000000-mapping.dmp
-
memory/1572-56-0x0000000000000000-mapping.dmp
-
memory/1840-57-0x0000000000000000-mapping.dmp
-
memory/1896-54-0x0000000076081000-0x0000000076083000-memory.dmpFilesize
8KB
-
memory/2028-59-0x0000000000000000-mapping.dmp