Analysis
-
max time kernel
154s -
max time network
163s -
platform
windows7_x64 -
resource
win7-20220715-en -
resource tags
arch:x64arch:x86image:win7-20220715-enlocale:en-usos:windows7-x64system -
submitted
31-07-2022 05:05
Static task
static1
Behavioral task
behavioral1
Sample
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe
Resource
win7-20220715-en
Behavioral task
behavioral2
Sample
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe
Resource
win10v2004-20220721-en
General
-
Target
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe
-
Size
172KB
-
MD5
e49ce76cfe71eb53e6ebc32b112ebdad
-
SHA1
e64787efdf916fa0e433e1ac4b462e89802ac1f4
-
SHA256
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2
-
SHA512
3cd32ab45a84299398e4da9b843f5231e3ec9339e196ebb54a81d705c69aed28b0543853427f1eb34ac891741fcb57fba083d1e268385b42d69c0d44ad1b5ac1
Malware Config
Signatures
-
Processes:
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe -
Processes:
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
iexplore.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\U440S6D3-S1J8-U7Y6-U224-P8W7P5Y1L7L6 = "C:\\Users\\Admin\\AppData\\Roaming\\U440S6D3-S1J8-U7Y6-U224-P8W7P5Y1L7L6\\U440S6D3-S1J8-U7Y6-U224-P8W7P5Y1L7L6.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run iexplore.exe -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1792 notepad.exe -
Processes:
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UACDisableNotify = "0" 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
iexplore.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\USER\S-1-5-21-335065374-4263250628-1829373619-1000\Software\Microsoft\Windows\CurrentVersion\Run\U440S6D3-S1J8-U7Y6-U224-P8W7P5Y1L7L6 = "C:\\Users\\Admin\\AppData\\Roaming\\U440S6D3-S1J8-U7Y6-U224-P8W7P5Y1L7L6\\U440S6D3-S1J8-U7Y6-U224-P8W7P5Y1L7L6.exe" iexplore.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\U440S6D3-S1J8-U7Y6-U224-P8W7P5Y1L7L6 = "C:\\Users\\Admin\\AppData\\Roaming\\U440S6D3-S1J8-U7Y6-U224-P8W7P5Y1L7L6\\U440S6D3-S1J8-U7Y6-U224-P8W7P5Y1L7L6.exe" iexplore.exe -
Processes:
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exedescription pid process target process PID 1996 set thread context of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 set thread context of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exepid process 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
iexplore.exedescription pid process Token: SeDebugPrivilege 1284 iexplore.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exeiexplore.exepid process 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe 1284 iexplore.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exeiexplore.exedescription pid process target process PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1992 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1996 wrote to memory of 1284 1996 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe iexplore.exe PID 1284 wrote to memory of 1792 1284 iexplore.exe notepad.exe PID 1284 wrote to memory of 1792 1284 iexplore.exe notepad.exe PID 1284 wrote to memory of 1792 1284 iexplore.exe notepad.exe PID 1284 wrote to memory of 1792 1284 iexplore.exe notepad.exe PID 1284 wrote to memory of 1792 1284 iexplore.exe notepad.exe PID 1284 wrote to memory of 1792 1284 iexplore.exe notepad.exe PID 1284 wrote to memory of 1792 1284 iexplore.exe notepad.exe PID 1284 wrote to memory of 1792 1284 iexplore.exe notepad.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe"C:\Users\Admin\AppData\Local\Temp\6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe"1⤵
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe2⤵
-
C:\Program Files (x86)\Internet Explorer\iexplore.exeC:\Users\Admin\AppData\Local\Temp\6cdc19ff655d60c2f9f5ea1d4397efa91e20a60581509b90664c556c30db34c2.exe2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exenotepad.exe3⤵
- Deletes itself