Analysis
-
max time kernel
52s -
max time network
153s -
platform
windows10-1703_x64 -
resource
win10-20220812-en -
resource tags
arch:x64arch:x86image:win10-20220812-enlocale:en-usos:windows10-1703-x64system -
submitted
11-09-2022 06:59
General
-
Target
7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe
-
Size
202KB
-
MD5
ee8464d03f6dd8ef012df411919b5c28
-
SHA1
e7f3dff5296ac6c2727efe7dc9d5323f3040df3a
-
SHA256
7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919
-
SHA512
dfb2ee6b4ffdace42f96579812f0569a284b0ec05299f6171278afd4f1cff7a50216e86f260eff2478d62a927caa52f9ada055b207ce72c5406766f8b498660c
-
SSDEEP
6144:gLV6Bta6dtJmakIM5zehjauz5+CE+RkLXUq:gLV6BtpmkdjBA2SLXV
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\UPNP Service = "C:\\Program Files (x86)\\UPNP Service\\upnpsvc.exe" 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe -
Processes:
7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe -
Drops file in Program Files directory 2 IoCs
Processes:
7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exedescription ioc process File created C:\Program Files (x86)\UPNP Service\upnpsvc.exe 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe File opened for modification C:\Program Files (x86)\UPNP Service\upnpsvc.exe 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exepid process 2584 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe 2584 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe 2584 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe 2584 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe 2584 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe 2584 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exepid process 2584 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exedescription pid process Token: SeDebugPrivilege 2584 7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe"C:\Users\Admin\AppData\Local\Temp\7b4d9dc287d4adfd6358374be3df420b2e725f3b66092c1d71b2653fa2c2f919.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2584-117-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-118-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-119-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-120-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-121-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-122-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-123-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-124-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-125-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-127-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-126-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-128-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-129-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-130-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-131-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-132-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-133-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-134-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-135-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-136-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-137-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-139-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-138-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-140-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-141-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-142-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-143-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-144-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-145-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-146-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-147-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-148-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-149-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-150-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-151-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-152-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-153-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-154-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-155-0x0000000073DC0000-0x0000000074370000-memory.dmpFilesize
5.7MB
-
memory/2584-156-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-157-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-158-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-159-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-160-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-161-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-162-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-163-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-164-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-165-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-166-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-167-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-168-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-169-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-170-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-171-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-172-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-173-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-174-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-175-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-176-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-177-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-178-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-179-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-180-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-181-0x0000000077A40000-0x0000000077BCE000-memory.dmpFilesize
1.6MB
-
memory/2584-191-0x0000000073DC0000-0x0000000074370000-memory.dmpFilesize
5.7MB