Analysis
-
max time kernel
33s -
max time network
39s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/09/2022, 08:09
Static task
static1
Behavioral task
behavioral1
Sample
cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe
Resource
win10v2004-20220901-en
General
-
Target
cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe
-
Size
88KB
-
MD5
cac1d9d852caf13ad928c955d4be94f3
-
SHA1
da92506ebe13438d402cf3cd0fe33a7f1d7bb00c
-
SHA256
cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039
-
SHA512
270f40b546cd441ba570e8c027255976a36fd4da12fa0c6f2f5819d8e395873c9609f0608203aea7c88ad5e67659cbb83347772a50718ec209fe24ff72fdde89
-
SSDEEP
1536:etXjdOpMTqgcCs4G6XCo3Fkxr+CnXTK63u+Yo7TfM1+:eVj8JCPG6SoVkxyCnOyzYoXMs
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1260 shstat.exe -
Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1797FA89-9F3C-4f48-AF63-6BE35D25ADE4} shstat.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{1797FA89-9F3C-4f48-AF63-6BE35D25ADE4}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\shstat.exe" shstat.exe -
Deletes itself 1 IoCs
pid Process 2036 cmd.exe -
Loads dropped DLL 2 IoCs
pid Process 1488 cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe 1488 cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\monkey.dll shstat.exe File opened for modification C:\Windows\monkey.dll shstat.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1488 cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe -
Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 1488 wrote to memory of 1260 1488 cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe 27 PID 1488 wrote to memory of 1260 1488 cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe 27 PID 1488 wrote to memory of 1260 1488 cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe 27 PID 1488 wrote to memory of 1260 1488 cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe 27 PID 1260 wrote to memory of 1272 1260 shstat.exe 29 PID 1260 wrote to memory of 1272 1260 shstat.exe 29 PID 1260 wrote to memory of 1272 1260 shstat.exe 29 PID 1260 wrote to memory of 1272 1260 shstat.exe 29 PID 1260 wrote to memory of 1272 1260 shstat.exe 29 PID 1260 wrote to memory of 1272 1260 shstat.exe 29 PID 1488 wrote to memory of 2036 1488 cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe 28 PID 1488 wrote to memory of 2036 1488 cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe 28 PID 1488 wrote to memory of 2036 1488 cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe 28 PID 1488 wrote to memory of 2036 1488 cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe"C:\Users\Admin\AppData\Local\Temp\cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Roaming\shstat.exeC:\Users\Admin\AppData\Roaming\shstat.exe2⤵
- Executes dropped EXE
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:1260 -
\??\c:\program files\internet explorer\iexplore.exe"c:\program files\internet explorer\iexplore.exe" http://about:blank3⤵PID:1272
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\CABF51~1.EXE > nul2⤵
- Deletes itself
PID:2036
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
88KB
MD5cac1d9d852caf13ad928c955d4be94f3
SHA1da92506ebe13438d402cf3cd0fe33a7f1d7bb00c
SHA256cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039
SHA512270f40b546cd441ba570e8c027255976a36fd4da12fa0c6f2f5819d8e395873c9609f0608203aea7c88ad5e67659cbb83347772a50718ec209fe24ff72fdde89
-
Filesize
88KB
MD5cac1d9d852caf13ad928c955d4be94f3
SHA1da92506ebe13438d402cf3cd0fe33a7f1d7bb00c
SHA256cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039
SHA512270f40b546cd441ba570e8c027255976a36fd4da12fa0c6f2f5819d8e395873c9609f0608203aea7c88ad5e67659cbb83347772a50718ec209fe24ff72fdde89
-
Filesize
88KB
MD5cac1d9d852caf13ad928c955d4be94f3
SHA1da92506ebe13438d402cf3cd0fe33a7f1d7bb00c
SHA256cabf51798d1c32937f34d57e6fc736b5e8b5e27eb86b7b1042b212c577051039
SHA512270f40b546cd441ba570e8c027255976a36fd4da12fa0c6f2f5819d8e395873c9609f0608203aea7c88ad5e67659cbb83347772a50718ec209fe24ff72fdde89