Analysis
-
max time kernel
143s -
max time network
53s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 14:43
Static task
static1
Behavioral task
behavioral1
Sample
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe
Resource
win10v2004-20220721-en
General
-
Target
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe
-
Size
427KB
-
MD5
55df99a116a1369f7ad5748a8c82c6ae
-
SHA1
c557457c271b7047df114672390c3ad4f0393b3a
-
SHA256
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b
-
SHA512
260a2728e38daff602cca99116ecdf2175210320b443895917de59d79885d49b96108f250871969e846881a42e7e2217b90e1d3e2486a14f1e2faae5f5b9d7cc
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\system32\\winlogon.exe" f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe -
Processes:
resource yara_rule behavioral1/memory/968-63-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral1/memory/968-65-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral1/memory/968-69-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral1/memory/968-70-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral1/memory/968-75-0x0000000013140000-0x00000000131FC000-memory.dmp upx behavioral1/memory/968-79-0x0000000013140000-0x00000000131FC000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exenotepad.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\system32\\winlogon.exe" f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Set value (str) \REGISTRY\USER\S-1-5-21-3440072777-2118400376-1759599358-1000\Software\Microsoft\Windows\CurrentVersion\Run\winlogon = "C:\\system32\\winlogon.exe" notepad.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exef175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exedescription pid process target process PID 1164 set thread context of 968 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 968 set thread context of 1320 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe explorer.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1756 1320 WerFault.exe explorer.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe -
Enumerates system info in registry 2 TTPs 1 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe -
Suspicious use of AdjustPrivilegeToken 23 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exedescription pid process Token: SeIncreaseQuotaPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeSecurityPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeTakeOwnershipPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeLoadDriverPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeSystemProfilePrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeSystemtimePrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeProfSingleProcessPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeIncBasePriorityPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeCreatePagefilePrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeBackupPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeRestorePrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeShutdownPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeDebugPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeSystemEnvironmentPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeChangeNotifyPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeRemoteShutdownPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeUndockPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeManageVolumePrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeImpersonatePrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: SeCreateGlobalPrivilege 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: 33 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: 34 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe Token: 35 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exeexplorer.exepid process 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe 1320 explorer.exe 1320 explorer.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exef175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exeexplorer.exedescription pid process target process PID 1164 wrote to memory of 968 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 1164 wrote to memory of 968 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 1164 wrote to memory of 968 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 1164 wrote to memory of 968 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 1164 wrote to memory of 968 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 1164 wrote to memory of 968 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 1164 wrote to memory of 968 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 1164 wrote to memory of 968 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 1164 wrote to memory of 968 1164 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1644 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe notepad.exe PID 968 wrote to memory of 1320 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe explorer.exe PID 968 wrote to memory of 1320 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe explorer.exe PID 968 wrote to memory of 1320 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe explorer.exe PID 968 wrote to memory of 1320 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe explorer.exe PID 968 wrote to memory of 1320 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe explorer.exe PID 968 wrote to memory of 1320 968 f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe explorer.exe PID 1320 wrote to memory of 1756 1320 explorer.exe WerFault.exe PID 1320 wrote to memory of 1756 1320 explorer.exe WerFault.exe PID 1320 wrote to memory of 1756 1320 explorer.exe WerFault.exe PID 1320 wrote to memory of 1756 1320 explorer.exe WerFault.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe"C:\Users\Admin\AppData\Local\Temp\f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe"C:\Users\Admin\AppData\Local\Temp\f175a4c17101843376c31e055083314a20b21f28c9a451aa159818463abd212b.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1320 -s 1484⤵
- Program crash
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/968-64-0x00000000131F90F0-mapping.dmp
-
memory/968-79-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/968-75-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/968-70-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/968-69-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/968-66-0x0000000076021000-0x0000000076023000-memory.dmpFilesize
8KB
-
memory/968-65-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/968-63-0x0000000013140000-0x00000000131FC000-memory.dmpFilesize
752KB
-
memory/1164-59-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/1164-56-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/1164-54-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/1164-67-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/1164-68-0x0000000002640000-0x0000000002750000-memory.dmpFilesize
1.1MB
-
memory/1164-58-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/1164-57-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/1164-55-0x0000000000400000-0x00000000007C2029-memory.dmpFilesize
3.8MB
-
memory/1164-60-0x0000000002640000-0x0000000002750000-memory.dmpFilesize
1.1MB
-
memory/1320-76-0x0000000000400000-0x00000000007C3000-memory.dmpFilesize
3.8MB
-
memory/1320-73-0x0000000000400000-0x00000000007C3000-memory.dmpFilesize
3.8MB
-
memory/1320-77-0x00000000007C2063-mapping.dmp
-
memory/1320-80-0x0000000000400000-0x00000000007C3000-memory.dmpFilesize
3.8MB
-
memory/1644-71-0x0000000000000000-mapping.dmp
-
memory/1756-81-0x0000000000000000-mapping.dmp