Analysis
-
max time kernel
150s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 15:07
Static task
static1
Behavioral task
behavioral1
Sample
55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exe
Resource
win7-20220718-en
General
-
Target
55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exe
-
Size
849KB
-
MD5
0f97c0600cb950fe9430023345529356
-
SHA1
0464e631d06da0bc9a18a4b1b6252c436686914a
-
SHA256
55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f
-
SHA512
327d97ba76ee59a3ed800fe66bc13627eab90ca5dd0fac4335251b961df38cba976ac308d0933f15bb16ec970accda46faf3687499c51c72f0d771dc421433da
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\EnableFirewall = "0" explorer.exe -
Executes dropped EXE 2 IoCs
Processes:
file name.exefile name.exepid process 1668 file name.exe 1268 file name.exe -
Sets file execution options in registry 2 TTPs 4 IoCs
Processes:
file name.exeexplorer.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7o1iy5c77a5.exe file name.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\7o1iy5c77a5.exe\DisableExceptionChainValidation file name.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rstrui.exe\Debugger = "bbb.exe" explorer.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
explorer.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion explorer.exe -
Loads dropped DLL 2 IoCs
Processes:
55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exepid process 1084 55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exe 1084 55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Registry Defragmenter = "C:\\ProgramData\\Registry Defragmenter\\7o1iy5c77a5.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Run\Registry Defragmenter = "\"C:\\ProgramData\\Registry Defragmenter\\7o1iy5c77a5.exe\"" explorer.exe Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce explorer.exe -
Processes:
file name.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file name.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 9 IoCs
Processes:
file name.exeexplorer.exepid process 1268 file name.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
file name.exedescription pid process target process PID 1668 set thread context of 1268 1668 file name.exe file name.exe -
Checks processor information in registry 2 TTPs 4 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
file name.exeexplorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 file name.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString file name.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
Processes:
explorer.exedescription ioc process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemManufacturer explorer.exe -
Modifies Internet Explorer Protected Mode 1 TTPs 4 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\2\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\3\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\4\2500 = "3" explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Zones\1\2500 = "3" explorer.exe -
Modifies Internet Explorer Protected Mode Banner 1 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main\NoProtectedModeBanner = "1" explorer.exe -
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4084403625-2215941253-1760665084-1000\Software\Microsoft\Internet Explorer\Main explorer.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
explorer.exepid process 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe 1548 explorer.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
file name.exeexplorer.exepid process 1268 file name.exe 1268 file name.exe 1548 explorer.exe 1548 explorer.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
Processes:
file name.exeexplorer.exedescription pid process Token: SeDebugPrivilege 1268 file name.exe Token: SeRestorePrivilege 1268 file name.exe Token: SeBackupPrivilege 1268 file name.exe Token: SeLoadDriverPrivilege 1268 file name.exe Token: SeCreatePagefilePrivilege 1268 file name.exe Token: SeShutdownPrivilege 1268 file name.exe Token: SeTakeOwnershipPrivilege 1268 file name.exe Token: SeChangeNotifyPrivilege 1268 file name.exe Token: SeCreateTokenPrivilege 1268 file name.exe Token: SeMachineAccountPrivilege 1268 file name.exe Token: SeSecurityPrivilege 1268 file name.exe Token: SeAssignPrimaryTokenPrivilege 1268 file name.exe Token: SeCreateGlobalPrivilege 1268 file name.exe Token: 33 1268 file name.exe Token: SeDebugPrivilege 1548 explorer.exe Token: SeRestorePrivilege 1548 explorer.exe Token: SeBackupPrivilege 1548 explorer.exe Token: SeLoadDriverPrivilege 1548 explorer.exe Token: SeCreatePagefilePrivilege 1548 explorer.exe Token: SeShutdownPrivilege 1548 explorer.exe Token: SeTakeOwnershipPrivilege 1548 explorer.exe Token: SeChangeNotifyPrivilege 1548 explorer.exe Token: SeCreateTokenPrivilege 1548 explorer.exe Token: SeMachineAccountPrivilege 1548 explorer.exe Token: SeSecurityPrivilege 1548 explorer.exe Token: SeAssignPrimaryTokenPrivilege 1548 explorer.exe Token: SeCreateGlobalPrivilege 1548 explorer.exe Token: 33 1548 explorer.exe -
Suspicious use of WriteProcessMemory 29 IoCs
Processes:
55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exefile name.exefile name.exeexplorer.exedescription pid process target process PID 1084 wrote to memory of 1668 1084 55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exe file name.exe PID 1084 wrote to memory of 1668 1084 55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exe file name.exe PID 1084 wrote to memory of 1668 1084 55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exe file name.exe PID 1084 wrote to memory of 1668 1084 55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exe file name.exe PID 1668 wrote to memory of 1268 1668 file name.exe file name.exe PID 1668 wrote to memory of 1268 1668 file name.exe file name.exe PID 1668 wrote to memory of 1268 1668 file name.exe file name.exe PID 1668 wrote to memory of 1268 1668 file name.exe file name.exe PID 1668 wrote to memory of 1268 1668 file name.exe file name.exe PID 1668 wrote to memory of 1268 1668 file name.exe file name.exe PID 1268 wrote to memory of 1548 1268 file name.exe explorer.exe PID 1268 wrote to memory of 1548 1268 file name.exe explorer.exe PID 1268 wrote to memory of 1548 1268 file name.exe explorer.exe PID 1268 wrote to memory of 1548 1268 file name.exe explorer.exe PID 1268 wrote to memory of 1548 1268 file name.exe explorer.exe PID 1268 wrote to memory of 1548 1268 file name.exe explorer.exe PID 1268 wrote to memory of 1548 1268 file name.exe explorer.exe PID 1548 wrote to memory of 1184 1548 explorer.exe Dwm.exe PID 1548 wrote to memory of 1184 1548 explorer.exe Dwm.exe PID 1548 wrote to memory of 1184 1548 explorer.exe Dwm.exe PID 1548 wrote to memory of 1184 1548 explorer.exe Dwm.exe PID 1548 wrote to memory of 1184 1548 explorer.exe Dwm.exe PID 1548 wrote to memory of 1184 1548 explorer.exe Dwm.exe PID 1548 wrote to memory of 1232 1548 explorer.exe Explorer.EXE PID 1548 wrote to memory of 1232 1548 explorer.exe Explorer.EXE PID 1548 wrote to memory of 1232 1548 explorer.exe Explorer.EXE PID 1548 wrote to memory of 1232 1548 explorer.exe Explorer.EXE PID 1548 wrote to memory of 1232 1548 explorer.exe Explorer.EXE PID 1548 wrote to memory of 1232 1548 explorer.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exe"C:\Users\Admin\AppData\Local\Temp\55bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\folder name\file name.exe"C:\Users\Admin\Documents\folder name\file name.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\Documents\folder name\file name.exe"C:\Users\Admin\Documents\folder name\file name.exe"4⤵
- Executes dropped EXE
- Sets file execution options in registry
- Checks whether UAC is enabled
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\explorer.exeC:\Windows\SysWOW64\explorer.exe5⤵
- Modifies firewall policy service
- Sets file execution options in registry
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Enumerates system info in registry
- Modifies Internet Explorer Protected Mode
- Modifies Internet Explorer Protected Mode Banner
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Documents\folder name\file name.exeFilesize
849KB
MD50f97c0600cb950fe9430023345529356
SHA10464e631d06da0bc9a18a4b1b6252c436686914a
SHA25655bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f
SHA512327d97ba76ee59a3ed800fe66bc13627eab90ca5dd0fac4335251b961df38cba976ac308d0933f15bb16ec970accda46faf3687499c51c72f0d771dc421433da
-
C:\Users\Admin\Documents\folder name\file name.exeFilesize
849KB
MD50f97c0600cb950fe9430023345529356
SHA10464e631d06da0bc9a18a4b1b6252c436686914a
SHA25655bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f
SHA512327d97ba76ee59a3ed800fe66bc13627eab90ca5dd0fac4335251b961df38cba976ac308d0933f15bb16ec970accda46faf3687499c51c72f0d771dc421433da
-
C:\Users\Admin\Documents\folder name\file name.exeFilesize
849KB
MD50f97c0600cb950fe9430023345529356
SHA10464e631d06da0bc9a18a4b1b6252c436686914a
SHA25655bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f
SHA512327d97ba76ee59a3ed800fe66bc13627eab90ca5dd0fac4335251b961df38cba976ac308d0933f15bb16ec970accda46faf3687499c51c72f0d771dc421433da
-
\Users\Admin\Documents\folder name\file name.exeFilesize
849KB
MD50f97c0600cb950fe9430023345529356
SHA10464e631d06da0bc9a18a4b1b6252c436686914a
SHA25655bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f
SHA512327d97ba76ee59a3ed800fe66bc13627eab90ca5dd0fac4335251b961df38cba976ac308d0933f15bb16ec970accda46faf3687499c51c72f0d771dc421433da
-
\Users\Admin\Documents\folder name\file name.exeFilesize
849KB
MD50f97c0600cb950fe9430023345529356
SHA10464e631d06da0bc9a18a4b1b6252c436686914a
SHA25655bf200391c8fba3a4b5dded96e2bde5798aa2dba263067035f2fa09ad32283f
SHA512327d97ba76ee59a3ed800fe66bc13627eab90ca5dd0fac4335251b961df38cba976ac308d0933f15bb16ec970accda46faf3687499c51c72f0d771dc421433da
-
memory/1084-54-0x0000000076291000-0x0000000076293000-memory.dmpFilesize
8KB
-
memory/1232-85-0x0000000002240000-0x0000000002246000-memory.dmpFilesize
24KB
-
memory/1268-70-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1268-75-0x0000000001DD0000-0x0000000001DDC000-memory.dmpFilesize
48KB
-
memory/1268-66-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1268-64-0x00000000004015C6-mapping.dmp
-
memory/1268-69-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1268-61-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1268-71-0x00000000002F0000-0x0000000000355000-memory.dmpFilesize
404KB
-
memory/1268-72-0x00000000002F0000-0x0000000000355000-memory.dmpFilesize
404KB
-
memory/1268-74-0x00000000003F0000-0x00000000003FD000-memory.dmpFilesize
52KB
-
memory/1268-67-0x0000000000400000-0x0000000000434000-memory.dmpFilesize
208KB
-
memory/1268-79-0x00000000002F0000-0x0000000000355000-memory.dmpFilesize
404KB
-
memory/1548-78-0x0000000074BB1000-0x0000000074BB3000-memory.dmpFilesize
8KB
-
memory/1548-76-0x0000000000000000-mapping.dmp
-
memory/1548-80-0x0000000077670000-0x00000000777F0000-memory.dmpFilesize
1.5MB
-
memory/1548-81-0x00000000001C0000-0x00000000002FD000-memory.dmpFilesize
1.2MB
-
memory/1548-82-0x0000000000360000-0x000000000036D000-memory.dmpFilesize
52KB
-
memory/1548-83-0x0000000000510000-0x000000000051C000-memory.dmpFilesize
48KB
-
memory/1548-84-0x0000000077670000-0x00000000777F0000-memory.dmpFilesize
1.5MB
-
memory/1668-57-0x0000000000000000-mapping.dmp