Analysis
-
max time kernel
135s -
max time network
220s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
25-07-2022 17:21
Static task
static1
Behavioral task
behavioral1
Sample
54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe
Resource
win7-20220718-en
Behavioral task
behavioral2
Sample
54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe
Resource
win10v2004-20220722-en
General
-
Target
54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe
-
Size
728KB
-
MD5
cf5eaf5016b20b65c805de7e5e074a85
-
SHA1
1b89c182e8421d1b28feec2308cfbb1ce455dd79
-
SHA256
54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422
-
SHA512
b3a6cb9d8d686ea1f4ce312ef6f0269cee5fa3df1eb773f672ff2aa2da6c6a0e1b40acedaa8e3fd1fb723304f0e61455886872fb0622368b64cc5a4e98d03158
Malware Config
Signatures
-
Processes:
Borland8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Borland8.exe -
Processes:
Borland8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" Borland8.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\A1F5W2I0-X6V4-U5T1-T8J1-J5Y8L0L337W4 = "C:\\Users\\Admin\\AppData\\Roaming\\A1F5W2I0-X6V4-U5T1-T8J1-J5Y8L0L337W4\\A1F5W2I0-X6V4-U5T1-T8J1-J5Y8L0L337W4.exe" iexplore.exe -
Executes dropped EXE 2 IoCs
Processes:
Borland8.exeBorland8.exepid process 1912 Borland8.exe 320 Borland8.exe -
Loads dropped DLL 3 IoCs
Processes:
54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exeBorland8.exepid process 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe 1912 Borland8.exe -
Processes:
Borland8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" Borland8.exe -
Adds Run key to start application 2 TTPs 6 IoCs
Processes:
iexplore.exereg.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\A1F5W2I0-X6V4-U5T1-T8J1-J5Y8L0L337W4 = "C:\\Users\\Admin\\AppData\\Roaming\\A1F5W2I0-X6V4-U5T1-T8J1-J5Y8L0L337W4\\A1F5W2I0-X6V4-U5T1-T8J1-J5Y8L0L337W4.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\A1F5W2I0-X6V4-U5T1-T8J1-J5Y8L0L337W4 = "C:\\Users\\Admin\\AppData\\Roaming\\A1F5W2I0-X6V4-U5T1-T8J1-J5Y8L0L337W4\\A1F5W2I0-X6V4-U5T1-T8J1-J5Y8L0L337W4.exe" iexplore.exe Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\Software\Microsoft\Windows\CurrentVersion\Run\Forsamlingshusets = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Borland8.exe" reg.EXE Key created \REGISTRY\USER\S-1-5-21-3762437355-3468409815-1164039494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe -
Processes:
Borland8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Borland8.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
Borland8.exeBorland8.exedescription pid process target process PID 1912 set thread context of 320 1912 Borland8.exe Borland8.exe PID 320 set thread context of 540 320 Borland8.exe iexplore.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
Borland8.exepid process 320 Borland8.exe 320 Borland8.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 540 iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exeBorland8.exeBorland8.exeiexplore.exepid process 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe 1912 Borland8.exe 320 Borland8.exe 540 iexplore.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exeBorland8.exeBorland8.exetaskeng.exedescription pid process target process PID 996 wrote to memory of 836 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe schtasks.exe PID 996 wrote to memory of 836 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe schtasks.exe PID 996 wrote to memory of 836 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe schtasks.exe PID 996 wrote to memory of 836 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe schtasks.exe PID 996 wrote to memory of 1444 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe schtasks.exe PID 996 wrote to memory of 1444 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe schtasks.exe PID 996 wrote to memory of 1444 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe schtasks.exe PID 996 wrote to memory of 1444 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe schtasks.exe PID 996 wrote to memory of 1912 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe Borland8.exe PID 996 wrote to memory of 1912 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe Borland8.exe PID 996 wrote to memory of 1912 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe Borland8.exe PID 996 wrote to memory of 1912 996 54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe Borland8.exe PID 1912 wrote to memory of 320 1912 Borland8.exe Borland8.exe PID 1912 wrote to memory of 320 1912 Borland8.exe Borland8.exe PID 1912 wrote to memory of 320 1912 Borland8.exe Borland8.exe PID 1912 wrote to memory of 320 1912 Borland8.exe Borland8.exe PID 1912 wrote to memory of 320 1912 Borland8.exe Borland8.exe PID 1912 wrote to memory of 320 1912 Borland8.exe Borland8.exe PID 1912 wrote to memory of 320 1912 Borland8.exe Borland8.exe PID 1912 wrote to memory of 320 1912 Borland8.exe Borland8.exe PID 1912 wrote to memory of 320 1912 Borland8.exe Borland8.exe PID 1912 wrote to memory of 320 1912 Borland8.exe Borland8.exe PID 320 wrote to memory of 540 320 Borland8.exe iexplore.exe PID 320 wrote to memory of 540 320 Borland8.exe iexplore.exe PID 320 wrote to memory of 540 320 Borland8.exe iexplore.exe PID 320 wrote to memory of 540 320 Borland8.exe iexplore.exe PID 320 wrote to memory of 540 320 Borland8.exe iexplore.exe PID 320 wrote to memory of 540 320 Borland8.exe iexplore.exe PID 320 wrote to memory of 540 320 Borland8.exe iexplore.exe PID 320 wrote to memory of 540 320 Borland8.exe iexplore.exe PID 320 wrote to memory of 540 320 Borland8.exe iexplore.exe PID 1036 wrote to memory of 1528 1036 taskeng.exe reg.EXE PID 1036 wrote to memory of 1528 1036 taskeng.exe reg.EXE PID 1036 wrote to memory of 1528 1036 taskeng.exe reg.EXE -
System policy modification 1 TTPs 1 IoCs
Processes:
Borland8.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" Borland8.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe"C:\Users\Admin\AppData\Local\Temp\54fe3fb46b47d290445662882ddf2e20b65306ff7d1ff1d9878b5b9ef5632422.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /Create /SC HOURLY /MO 23 /TN "Forsamlingshusets" /TR "reg add "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "\""Forsamlingshusets"\"" /f /t REG_SZ /d "\""C:\Users\Admin\AppData\Local\Temp\Borland8.exe\""2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\System32\schtasks.exe" /run /tn "Forsamlingshusets"2⤵
-
C:\Users\Admin\AppData\Local\Temp\Borland8.exe"C:\Users\Admin\AppData\Local\Temp\Borland8.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Borland8.exe"C:\Users\Admin\AppData\Local\Temp\Borland8.exe"3⤵
- UAC bypass
- Windows security bypass
- Executes dropped EXE
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\Borland8.exe4⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\taskeng.exetaskeng.exe {A1624953-5AC9-4971-B0FD-0B164C4E3352} S-1-5-21-3762437355-3468409815-1164039494-1000:TZEOUYSL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.EXEC:\Windows\system32\reg.EXE add HKCU\Software\Microsoft\Windows\CurrentVersion\Run /v "Forsamlingshusets" /f /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Borland8.exe"2⤵
- Adds Run key to start application
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\Borland8.exeFilesize
728KB
MD5ef41b5d8c942469a54c6bc3d7820f875
SHA1cf3b1e9d07ea0046e0dbb2cc679165ab66bfd45c
SHA2561ae554428c74e230e1b1e89b709630d36cc0e31d42a07c7555e5727809dfe85f
SHA51268b06f59d290acabfbafad73558eb9229cb5f2b4a99723bf7b02e139b60fecec827a2d05c40229d1b63c0cd105fe0581dc282eb71f1f5c53b64b424679cafb7a
-
C:\Users\Admin\AppData\Local\Temp\Borland8.exeFilesize
728KB
MD5ef41b5d8c942469a54c6bc3d7820f875
SHA1cf3b1e9d07ea0046e0dbb2cc679165ab66bfd45c
SHA2561ae554428c74e230e1b1e89b709630d36cc0e31d42a07c7555e5727809dfe85f
SHA51268b06f59d290acabfbafad73558eb9229cb5f2b4a99723bf7b02e139b60fecec827a2d05c40229d1b63c0cd105fe0581dc282eb71f1f5c53b64b424679cafb7a
-
C:\Users\Admin\AppData\Local\Temp\Borland8.exeFilesize
728KB
MD5ef41b5d8c942469a54c6bc3d7820f875
SHA1cf3b1e9d07ea0046e0dbb2cc679165ab66bfd45c
SHA2561ae554428c74e230e1b1e89b709630d36cc0e31d42a07c7555e5727809dfe85f
SHA51268b06f59d290acabfbafad73558eb9229cb5f2b4a99723bf7b02e139b60fecec827a2d05c40229d1b63c0cd105fe0581dc282eb71f1f5c53b64b424679cafb7a
-
\Users\Admin\AppData\Local\Temp\Borland8.exeFilesize
728KB
MD5ef41b5d8c942469a54c6bc3d7820f875
SHA1cf3b1e9d07ea0046e0dbb2cc679165ab66bfd45c
SHA2561ae554428c74e230e1b1e89b709630d36cc0e31d42a07c7555e5727809dfe85f
SHA51268b06f59d290acabfbafad73558eb9229cb5f2b4a99723bf7b02e139b60fecec827a2d05c40229d1b63c0cd105fe0581dc282eb71f1f5c53b64b424679cafb7a
-
\Users\Admin\AppData\Local\Temp\Borland8.exeFilesize
728KB
MD5ef41b5d8c942469a54c6bc3d7820f875
SHA1cf3b1e9d07ea0046e0dbb2cc679165ab66bfd45c
SHA2561ae554428c74e230e1b1e89b709630d36cc0e31d42a07c7555e5727809dfe85f
SHA51268b06f59d290acabfbafad73558eb9229cb5f2b4a99723bf7b02e139b60fecec827a2d05c40229d1b63c0cd105fe0581dc282eb71f1f5c53b64b424679cafb7a
-
\Users\Admin\AppData\Local\Temp\Borland8.exeFilesize
728KB
MD5ef41b5d8c942469a54c6bc3d7820f875
SHA1cf3b1e9d07ea0046e0dbb2cc679165ab66bfd45c
SHA2561ae554428c74e230e1b1e89b709630d36cc0e31d42a07c7555e5727809dfe85f
SHA51268b06f59d290acabfbafad73558eb9229cb5f2b4a99723bf7b02e139b60fecec827a2d05c40229d1b63c0cd105fe0581dc282eb71f1f5c53b64b424679cafb7a
-
memory/320-72-0x00000000004010B8-mapping.dmp
-
memory/320-71-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/320-80-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/320-79-0x0000000000400000-0x000000000042C000-memory.dmpFilesize
176KB
-
memory/836-59-0x0000000000000000-mapping.dmp
-
memory/996-58-0x00000000760F1000-0x00000000760F3000-memory.dmpFilesize
8KB
-
memory/996-56-0x0000000077C10000-0x0000000077DB9000-memory.dmpFilesize
1.7MB
-
memory/996-57-0x0000000077DF0000-0x0000000077F70000-memory.dmpFilesize
1.5MB
-
memory/996-67-0x0000000077DF0000-0x0000000077F70000-memory.dmpFilesize
1.5MB
-
memory/1444-60-0x0000000000000000-mapping.dmp
-
memory/1528-81-0x0000000000000000-mapping.dmp
-
memory/1912-75-0x0000000077C10000-0x0000000077DB9000-memory.dmpFilesize
1.7MB
-
memory/1912-76-0x0000000077DF0000-0x0000000077F70000-memory.dmpFilesize
1.5MB
-
memory/1912-63-0x0000000000000000-mapping.dmp