Analysis
-
max time kernel
147s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
18-09-2022 05:13
Behavioral task
behavioral1
Sample
22222fe8c78e190c9923a5be30bf70f2.exe
Resource
win7-20220812-en
General
-
Target
22222fe8c78e190c9923a5be30bf70f2.exe
-
Size
301KB
-
MD5
22222fe8c78e190c9923a5be30bf70f2
-
SHA1
b739e6e2e9742a49c35d1a6e3e16e0952e3b79f1
-
SHA256
d6bc9ba82038699dfb5d3b6bc02c8a88ad96004c40c03391a8ae39a6d9b2aa89
-
SHA512
a560a28c05a23b718e275a3e3cf4fc1aa8c0043b424145c96cfd4f561f73032789948abf69a5a35c63e7c3fd26cca5dd401ded08860d46aa3db94c85a46afa0c
-
SSDEEP
6144:KLV6Bta6dtJmakIM5XZ0lGKZ4Cy8Mts/7zyE5eh7:KLV6Btpmk6Z0lGKZa8x3yH7
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
22222fe8c78e190c9923a5be30bf70f2.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DDP Manager = "C:\\Program Files (x86)\\DDP Manager\\ddpmgr.exe" 22222fe8c78e190c9923a5be30bf70f2.exe -
Processes:
22222fe8c78e190c9923a5be30bf70f2.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 22222fe8c78e190c9923a5be30bf70f2.exe -
Drops file in Program Files directory 2 IoCs
Processes:
22222fe8c78e190c9923a5be30bf70f2.exedescription ioc process File created C:\Program Files (x86)\DDP Manager\ddpmgr.exe 22222fe8c78e190c9923a5be30bf70f2.exe File opened for modification C:\Program Files (x86)\DDP Manager\ddpmgr.exe 22222fe8c78e190c9923a5be30bf70f2.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4944 schtasks.exe 2700 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
22222fe8c78e190c9923a5be30bf70f2.exepid process 4452 22222fe8c78e190c9923a5be30bf70f2.exe 4452 22222fe8c78e190c9923a5be30bf70f2.exe 4452 22222fe8c78e190c9923a5be30bf70f2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
22222fe8c78e190c9923a5be30bf70f2.exepid process 4452 22222fe8c78e190c9923a5be30bf70f2.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
22222fe8c78e190c9923a5be30bf70f2.exedescription pid process Token: SeDebugPrivilege 4452 22222fe8c78e190c9923a5be30bf70f2.exe Token: SeDebugPrivilege 4452 22222fe8c78e190c9923a5be30bf70f2.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
22222fe8c78e190c9923a5be30bf70f2.exedescription pid process target process PID 4452 wrote to memory of 4944 4452 22222fe8c78e190c9923a5be30bf70f2.exe schtasks.exe PID 4452 wrote to memory of 4944 4452 22222fe8c78e190c9923a5be30bf70f2.exe schtasks.exe PID 4452 wrote to memory of 4944 4452 22222fe8c78e190c9923a5be30bf70f2.exe schtasks.exe PID 4452 wrote to memory of 2700 4452 22222fe8c78e190c9923a5be30bf70f2.exe schtasks.exe PID 4452 wrote to memory of 2700 4452 22222fe8c78e190c9923a5be30bf70f2.exe schtasks.exe PID 4452 wrote to memory of 2700 4452 22222fe8c78e190c9923a5be30bf70f2.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\22222fe8c78e190c9923a5be30bf70f2.exe"C:\Users\Admin\AppData\Local\Temp\22222fe8c78e190c9923a5be30bf70f2.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager" /xml "C:\Users\Admin\AppData\Local\Temp\tmpC885.tmp"2⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DDP Manager Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpCA1C.tmp"2⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpC885.tmpFilesize
1KB
MD5ca2d04519387fb4bf9b0c9c40e62c9cd
SHA1902e9dea64452a87839d26210706acdf72b436cc
SHA256458164fc84c4e0787182976841ac0270d6c9a5292387c6154e81e0cd2746968b
SHA5120b33e488bc0adc23481bf1a18f208d7a9efc516ae068cd5ba8f20ec8dff3c5e8adf904ef04b790f45e9c76dbb2f52baff9ea5fcd18fb721f08a8ed7b0ca6c2bf
-
C:\Users\Admin\AppData\Local\Temp\tmpCA1C.tmpFilesize
1KB
MD5677848190631e19222304d1982aa2e1b
SHA1bed6cf97d3458e4ea59ff9823375d915a9b3d682
SHA2568bcf16c788d228932fa707bb4250c05151e099bdf7040adc717e53680601be3d
SHA512f5d41e150011bc63f4c95799e21fe91ffaa25eb05f4ca46ea89f3a3ca5325413ba4e0b7b5d69c0bc189955f3308c4928016a7cc1d6f7c2352639106952e92b1e
-
memory/2700-135-0x0000000000000000-mapping.dmp
-
memory/4452-132-0x0000000074740000-0x0000000074CF1000-memory.dmpFilesize
5.7MB
-
memory/4452-137-0x0000000074740000-0x0000000074CF1000-memory.dmpFilesize
5.7MB
-
memory/4944-133-0x0000000000000000-mapping.dmp