Analysis
-
max time kernel
149s -
max time network
156s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 07:03
Static task
static1
Behavioral task
behavioral1
Sample
2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe
Resource
win7-20220901-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe
-
Size
219KB
-
MD5
b2d8673960cb0aaf44841251114ba809
-
SHA1
6e83dc62e472acbfb46dc138c74a1c3e5f0ea44e
-
SHA256
2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf
-
SHA512
b0af1901c611184b822d43582d2cf2fe35404d956170a9f5be6b274534e638d331c411196681aaffd1354f02c683795105d4bcf2061be69ba5e1d9f30a92e009
-
SSDEEP
1536:ssomCNilSglahGExex1B61JsBttY2BkBFFc/AM8tpUnkUynouy88Q:sLBijlKG1B6YXYfBooM8PUnxqout8Q
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 1 IoCs
pid Process 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\360se = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe" 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\z: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\i: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\j: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\o: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\q: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\r: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\s: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\u: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\g: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\k: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\p: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\t: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\v: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\w: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\f: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\h: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\m: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\x: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\e: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\l: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\n: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened (read-only) \??\y: 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\7091945.DEP 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\rgdltecq\ohoifz.pif 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe File opened for modification C:\Program Files (x86)\Common Files\rgdltecq\ohoifz.pif 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 568 sc.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe Token: SeDebugPrivilege 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 992 wrote to memory of 592 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 27 PID 992 wrote to memory of 592 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 27 PID 992 wrote to memory of 592 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 27 PID 992 wrote to memory of 592 992 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe 27 PID 592 wrote to memory of 568 592 cmd.exe 29 PID 592 wrote to memory of 568 592 cmd.exe 29 PID 592 wrote to memory of 568 592 cmd.exe 29 PID 592 wrote to memory of 568 592 cmd.exe 29 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe"C:\Users\Admin\AppData\Local\Temp\2ffafcd4df11617e1e95e2c8d57dea45774ca164e214c04074e6407568281faf.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:992 -
C:\Windows\SysWOW64\cmd.execmd /c sc stop policyagent2⤵
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\SysWOW64\sc.exesc stop policyagent3⤵
- Launches sc.exe
PID:568
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.1MB
MD5fe2c9d7f8b89e3c9b434a49e1e4c2512
SHA102da43259db834b4ec5155b176a9dc107bc48888
SHA256cb103325583d2c348d7866435080e529b6952bc0e296a195df39b0e4304b313f
SHA512d38123389c759a9c15d2e3991d8cf226cbd5fb1608d68a971e5ae9f693ccca8282d9848229cf27a524731f7d851922a9379271ca7cf39c95eb00e42bfb8aa47b