Analysis

  • max time kernel
    110s
  • max time network
    42s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    19/09/2022, 07:08

General

  • Target

    cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe

  • Size

    1.1MB

  • MD5

    34959373b12605d845f9aaa1b5e6a718

  • SHA1

    dceaabf833dc200642ed945996aef20562d6c5fd

  • SHA256

    cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d

  • SHA512

    984a158d67eecb46526ff15680fda42154bfb974013861c7db5d190ae8ecb7769dc38fef0cb1b67f3a7cf8d0cb33c52f2e560afbca54319b21bbfded6daeb86c

  • SSDEEP

    12288:lenxWYKa5A932NNHoOKGzSDBfy/18Qd1opGJpXWsyFLr7xC76N4bJVVv5LloUEoP:lenMnpquXGzgey5uNwFLr7gBVVvhz1

Score
10/10

Malware Config

Signatures

  • Modifies WinLogon for persistence 2 TTPs 1 IoCs
  • Checks BIOS information in registry 2 TTPs 2 IoCs

    BIOS information is often read in order to detect sandboxing environments.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Windows directory 2 IoCs
  • Modifies registry class 12 IoCs
  • NTFS ADS 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe
    "C:\Users\Admin\AppData\Local\Temp\cfeb1e670dac64b057eec3d0dee1fff018e64e081b5b67dc54f715a672fe229d.exe"
    1⤵
    • Modifies WinLogon for persistence
    • Checks BIOS information in registry
    • Drops file in System32 directory
    • Drops file in Windows directory
    • Modifies registry class
    • NTFS ADS
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    PID:1608

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1608-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

    Filesize

    8KB

  • memory/1608-55-0x0000000000B70000-0x0000000000C04000-memory.dmp

    Filesize

    592KB

  • memory/1608-60-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1608-61-0x0000000000550000-0x0000000000692000-memory.dmp

    Filesize

    1.3MB

  • memory/1608-62-0x0000000000B71000-0x0000000000BDE000-memory.dmp

    Filesize

    436KB

  • memory/1608-63-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1608-65-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1608-66-0x0000000000401000-0x000000000040A000-memory.dmp

    Filesize

    36KB

  • memory/1608-64-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB

  • memory/1608-69-0x0000000000400000-0x0000000000542000-memory.dmp

    Filesize

    1.3MB