Analysis
-
max time kernel
110s -
max time network
42s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 07:08
Static task
static1
Behavioral task
behavioral1
Sample
cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
Resource
win10v2004-20220812-en
General
-
Target
cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
-
Size
1.1MB
-
MD5
34959373b12605d845f9aaa1b5e6a718
-
SHA1
dceaabf833dc200642ed945996aef20562d6c5fd
-
SHA256
cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d
-
SHA512
984a158d67eecb46526ff15680fda42154bfb974013861c7db5d190ae8ecb7769dc38fef0cb1b67f3a7cf8d0cb33c52f2e560afbca54319b21bbfded6daeb86c
-
SSDEEP
12288:lenxWYKa5A932NNHoOKGzSDBfy/18Qd1opGJpXWsyFLr7xC76N4bJVVv5LloUEoP:lenMnpquXGzgey5uNwFLr7gBVVvhz1
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe C:\\WINDOWS\\Config\\csrss.exe" cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\SysWOW64\MSWINSCK.OCX cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\WINDOWS\Config\csrss.exe cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe File created C:\WINDOWS\Config\csrss.exe cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe -
Modifies registry class 12 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\ = "TokenActivation Class" cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\InprocServer32\ThreadingModel = "Free" cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\TypeLib cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\VersionIndependentProgID\ = "SppComApi.TokenActivation" cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A} cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\InprocServer32 cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\InprocServer32\ = "%SystemRoot%\\SysWow64\\sppcomapi.dll" cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\ProgID cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\ProgID\ = "SppComApi.TokenActivation.1" cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\TypeLib\ = "{B0C2A63F-AFF8-40E3-B42D-8A542DC909EC}" cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\VersionIndependentProgID cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{E8DB602E-6034-3D8F-6723-3382669DC88A}\AppID = "{6D9A7A40-DDCA-414E-B48E-DFB032C03C1B}" cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe -
NTFS ADS 2 IoCs
description ioc Process File created C:\ProgramData\TEMP:58FB35AD cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe File opened for modification C:\ProgramData\TEMP:58FB35AD cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: 33 1608 cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe Token: SeIncBasePriorityPrivilege 1608 cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1608 cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe"C:\Users\Admin\AppData\Local\Temp\cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1608