22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf

Analysis

max time kernel
116s
max time network
122s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 14:38

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf.exe
Size

242KB
MD5

03cc0662c097f33e251014eba9ca8709
SHA1

9a6494e58c2750847ec6f6e01c21ae83fb0f8216
SHA256

22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf
SHA512

17ebdbc83f45b820cb2dd10949254a23e7eb60c5972837f5975f9c0c3f579dfada836d1e610c20e95774e010aa852695f6c604bfbb7c7c8f67b3cb68033b7b60
SSDEEP

6144:Rkmk/e2bsvPunAdHbzwZlhRoFKPXdUg+pjZpyyw5:Rfk/DwvGsf0hvXP+pjC

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1120	Service.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Service.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\Service.exe	22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf.exe
File opened for modification	C:\Windows\Service.exe	22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf.exe

Modifies data under HKEY_USERS 33 IoCs

description	ioc	Process
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1CEB3472-7C1C-4F15-A73B-6DAE5BDFD376}\WpadDecisionTime = b0fd68d071ccd801	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-f4-c1-dc-34-de\WpadDecision = "0"	Service.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties	Service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0004000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm\wheel = "1"	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1CEB3472-7C1C-4F15-A73B-6DAE5BDFD376}	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1CEB3472-7C1C-4F15-A73B-6DAE5BDFD376}\WpadDecision = "0"	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-f4-c1-dc-34-de	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1CEB3472-7C1C-4F15-A73B-6DAE5BDFD376}\f6-f4-c1-dc-34-de	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1CEB3472-7C1C-4F15-A73B-6DAE5BDFD376}\WpadDecisionReason = "1"	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Service.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-f4-c1-dc-34-de\WpadDecisionReason = "1"	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\System	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Control\MediaProperties\PrivateProperties\Joystick\Winmm	Service.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Service.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Service.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{1CEB3472-7C1C-4F15-A73B-6DAE5BDFD376}\WpadNetworkName = "Network 2"	Service.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\f6-f4-c1-dc-34-de\WpadDecisionTime = b0fd68d071ccd801	Service.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Service.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1500	22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf.exe
Token: SeDebugPrivilege	1120	Service.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1120	Service.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1120 wrote to memory of 2028	1120	Service.exe	28
PID 1120 wrote to memory of 2028	1120	Service.exe	28
PID 1120 wrote to memory of 2028	1120	Service.exe	28
PID 1120 wrote to memory of 2028	1120	Service.exe	28

C:\Users\Admin\AppData\Local\Temp\22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf.exe
"C:\Users\Admin\AppData\Local\Temp\22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:1500

C:\Windows\Service.exe
C:\Windows\Service.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1120
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2028

C:\Windows\system32\AUDIODG.EXE
C:\Windows\system32\AUDIODG.EXE 0x4e8
1⤵
PID:1292

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\Service.exe

Filesize
242KB

MD5
03cc0662c097f33e251014eba9ca8709

SHA1
9a6494e58c2750847ec6f6e01c21ae83fb0f8216

SHA256
22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf

SHA512
17ebdbc83f45b820cb2dd10949254a23e7eb60c5972837f5975f9c0c3f579dfada836d1e610c20e95774e010aa852695f6c604bfbb7c7c8f67b3cb68033b7b60

Download Submit
C:\Windows\Service.exe

Filesize
242KB

MD5
03cc0662c097f33e251014eba9ca8709

SHA1
9a6494e58c2750847ec6f6e01c21ae83fb0f8216

SHA256
22f435847b897bc0bcb66d427174c0421ef6161961d192902ed2bf2828663caf

SHA512
17ebdbc83f45b820cb2dd10949254a23e7eb60c5972837f5975f9c0c3f579dfada836d1e610c20e95774e010aa852695f6c604bfbb7c7c8f67b3cb68033b7b60

Download Submit
memory/1120-60-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1120-61-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download
memory/1120-62-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1120-63-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download
memory/1500-54-0x0000000075D71000-0x0000000075D73000-memory.dmp

Filesize
8KB

Download
memory/1500-55-0x0000000000400000-0x00000000004EC000-memory.dmp

Filesize
944KB

Download
memory/1500-56-0x0000000000250000-0x0000000000254000-memory.dmp

Filesize
16KB

Download