cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419

Analysis

max time kernel
149s
max time network
156s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 02:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe
Size

148KB
MD5

475f7bfbdd649d939feb3982688e214f
SHA1

0a317fd6571db6e7770cf4084cdb3050f036e625
SHA256

cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419
SHA512

b2d9cca9c916bd556a3b1241aa09ae1ec3ca5000d7307d9d6946fb8243f76737e07f86011edb0e9bb0229445771fb2313b64b7a543c4d7950aa8ec0c665a1331
SSDEEP

1536:YvtawKCWgxdXv82Oj+P2YegT/CjgmeJs2wAj:Yv+Iv8tjkLegT/8gmeTj

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\pcidump.sys	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe
File opened for modification	C:\Windows\system32\drivers\etc\hosts	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe

Drops autorun.inf file 1 TTPs 2 IoCs

Malware can abuse Windows Autorun to spread further via attached volumes.

Replication Through Removable Media

T1091

description	ioc	Process
File created	C:\autorun.inf	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe
File opened for modification	C:\autorun.inf	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\func.dll	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\phpq.dll	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe

Launches sc.exe 1 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1816	sc.exe

Gathers network information 2 TTPs 1 IoCs

Uses commandline utility to view network configuration.

System Information Discovery

T1082

Command-Line Interface

T1059

pid	Process
1172	ipconfig.exe

Kills process with taskkill 3 IoCs

evasion

pid	Process
2040	taskkill.exe
884	taskkill.exe
1812	taskkill.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
460	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2040	taskkill.exe
Token: SeDebugPrivilege	884	taskkill.exe
Token: SeDebugPrivilege	1812	taskkill.exe

Suspicious use of WriteProcessMemory 59 IoCs

description	pid	Process	procid_target
PID 1048 wrote to memory of 1928	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	27
PID 1048 wrote to memory of 1928	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	27
PID 1048 wrote to memory of 1928	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	27
PID 1048 wrote to memory of 1928	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	27
PID 1048 wrote to memory of 2016	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	30
PID 1048 wrote to memory of 2016	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	30
PID 1048 wrote to memory of 2016	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	30
PID 1048 wrote to memory of 2016	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	30
PID 1048 wrote to memory of 2008	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	28
PID 1048 wrote to memory of 2008	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	28
PID 1048 wrote to memory of 2008	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	28
PID 1048 wrote to memory of 2008	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	28
PID 1048 wrote to memory of 1372	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	32
PID 1048 wrote to memory of 1372	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	32
PID 1048 wrote to memory of 1372	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	32
PID 1048 wrote to memory of 1372	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	32
PID 1048 wrote to memory of 2020	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	34
PID 1048 wrote to memory of 2020	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	34
PID 1048 wrote to memory of 2020	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	34
PID 1048 wrote to memory of 2020	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	34
PID 1048 wrote to memory of 1132	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	35
PID 1048 wrote to memory of 1132	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	35
PID 1048 wrote to memory of 1132	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	35
PID 1048 wrote to memory of 1132	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	35
PID 1928 wrote to memory of 1724	1928	cmd.exe	39
PID 2016 wrote to memory of 1728	2016	cmd.exe	38
PID 1928 wrote to memory of 1724	1928	cmd.exe	39
PID 1928 wrote to memory of 1724	1928	cmd.exe	39
PID 1928 wrote to memory of 1724	1928	cmd.exe	39
PID 2016 wrote to memory of 1728	2016	cmd.exe	38
PID 2016 wrote to memory of 1728	2016	cmd.exe	38
PID 2016 wrote to memory of 1728	2016	cmd.exe	38
PID 2020 wrote to memory of 884	2020	cmd.exe	43
PID 2020 wrote to memory of 884	2020	cmd.exe	43
PID 2020 wrote to memory of 884	2020	cmd.exe	43
PID 2020 wrote to memory of 884	2020	cmd.exe	43
PID 2008 wrote to memory of 1816	2008	cmd.exe	41
PID 2008 wrote to memory of 1816	2008	cmd.exe	41
PID 2008 wrote to memory of 1816	2008	cmd.exe	41
PID 2008 wrote to memory of 1816	2008	cmd.exe	41
PID 1372 wrote to memory of 2040	1372	cmd.exe	42
PID 1372 wrote to memory of 2040	1372	cmd.exe	42
PID 1372 wrote to memory of 2040	1372	cmd.exe	42
PID 1372 wrote to memory of 2040	1372	cmd.exe	42
PID 1132 wrote to memory of 1812	1132	cmd.exe	44
PID 1132 wrote to memory of 1812	1132	cmd.exe	44
PID 1132 wrote to memory of 1812	1132	cmd.exe	44
PID 1132 wrote to memory of 1812	1132	cmd.exe	44
PID 1048 wrote to memory of 2004	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	46
PID 1048 wrote to memory of 2004	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	46
PID 1048 wrote to memory of 2004	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	46
PID 1048 wrote to memory of 2004	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	46
PID 1048 wrote to memory of 2004	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	46
PID 1048 wrote to memory of 2004	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	46
PID 1048 wrote to memory of 2004	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	46
PID 1048 wrote to memory of 1172	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	47
PID 1048 wrote to memory of 1172	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	47
PID 1048 wrote to memory of 1172	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	47
PID 1048 wrote to memory of 1172	1048	cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe	47

C:\Users\Admin\AppData\Local\Temp\cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe
"C:\Users\Admin\AppData\Local\Temp\cf3b3867bcaa43291397b34a5d5aef730ecf529c2e53d898a98bcc39a572a419.exe"
1⤵
- Drops file in Drivers directory
- Drops autorun.inf file
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1048
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls C:\Windows /e /p everyone:f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1928
- - C:\Windows\SysWOW64\cacls.exe
    cacls C:\Windows /e /p everyone:f
    3⤵
    PID:1724
- C:\Windows\SysWOW64\cmd.exe
  cmd /c sc config ekrn start= disabled
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2008
- - C:\Windows\SysWOW64\sc.exe
    sc config ekrn start= disabled
    3⤵
    - Launches sc.exe
    PID:1816
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cacls "C:\Users\Admin\AppData\Local\Temp\" /e /p everyone:f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2016
- - C:\Windows\SysWOW64\cacls.exe
    cacls "C:\Users\Admin\AppData\Local\Temp\" /e /p everyone:f
    3⤵
    PID:1728
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im ekrn.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1372
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im ekrn.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:2040
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im egui.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2020
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im egui.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:884
- C:\Windows\SysWOW64\cmd.exe
  cmd /c taskkill /im ScanFrm.exe /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1132
- - C:\Windows\SysWOW64\taskkill.exe
    taskkill /im ScanFrm.exe /f
    3⤵
    - Kills process with taskkill
    - Suspicious use of AdjustPrivilegeToken
    PID:1812
- C:\Windows\SysWOW64\rundll32.exe
  rundll32.exe func.dll, droqp
  2⤵
  PID:2004
- C:\Windows\SysWOW64\ipconfig.exe
  ipconfig /all
  2⤵
  - Gathers network information
  PID:1172

Network

MITRE ATT&CK Enterprise v6

Initial Access

Replication Through Removable Media

T1091

Execution

Command-Line Interface

T1059

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Replication Through Removable Media

T1091

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\func.dll

Filesize
37KB

MD5
f384de596b479af7460d2c683928bdb5

SHA1
bd51d3f1fa4d7b7bf6d3b26d5170e2356e9e01f5

SHA256
5a8e8691be891df1fa4ed90103f6f46e306c3349d3ad00b436ecd26de964d635

SHA512
1eb57475029ec482c33dae53f266dd6ab1b6b9d51628b7760218ce51faaba5f4a381769e1e5306a5aeadfa67d3b89e73f9b822bfbe1dd66441a8e6ff816c2809

Download Submit
memory/1048-66-0x0000000000400000-0x0000000000425000-memory.dmp

Filesize
148KB

Download
memory/2004-68-0x00000000759F1000-0x00000000759F3000-memory.dmp

Filesize
8KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads