eff4b0ef791434d123670c4729fc88c36786e6f353150d3fa35325832f967330

Analysis

max time kernel
134s
max time network
104s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
19/09/2022, 18:27

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eff4b0ef791434d123670c4729fc88c36786e6f353150d3fa35325832f967330.exe
Size

631KB
MD5

0e57c551b83cc1c5ae63721fd8eaf4a1
SHA1

e93fe1bbc31984fcb145a4e541630d51dfeaec20
SHA256

eff4b0ef791434d123670c4729fc88c36786e6f353150d3fa35325832f967330
SHA512

7eb583c8486fe204033e6f926ce9652e2b45b9d2715bfba55a5d06afdb845b8ea888cce8109930176d11d103a5985f33ae586f4030de92d5209b6160481f62f8
SSDEEP

12288:z61nWxB4w8VwYHKenvmNEn1UJRNuIHw4F3Z4mxx+fFpCDRGNyHIxn:2MU5HKeONE1UJq8QmXCpCDcksn

Score

8^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1924	System.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	System.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\System.exe	eff4b0ef791434d123670c4729fc88c36786e6f353150d3fa35325832f967330.exe
File opened for modification	C:\Windows\System.exe	eff4b0ef791434d123670c4729fc88c36786e6f353150d3fa35325832f967330.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0960BCE-F7EF-41F0-B6E5-D7CCCEC6DE3A}\WpadNetworkName = "Network 2"	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-e6-6e-72-b9-fc\WpadDecisionTime = a03279189fccd801	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-e6-6e-72-b9-fc\WpadDetectedUrl	System.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-e6-6e-72-b9-fc\WpadDecisionTime = e099ac4c9fccd801	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	System.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0960BCE-F7EF-41F0-B6E5-D7CCCEC6DE3A}\5e-e6-6e-72-b9-fc	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	System.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0960BCE-F7EF-41F0-B6E5-D7CCCEC6DE3A}	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0960BCE-F7EF-41F0-B6E5-D7CCCEC6DE3A}\WpadDecisionTime = a03279189fccd801	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0960BCE-F7EF-41F0-B6E5-D7CCCEC6DE3A}\WpadDecision = "0"	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-e6-6e-72-b9-fc\WpadDecisionReason = "1"	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f000c000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	System.exe
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-e6-6e-72-b9-fc	System.exe
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0960BCE-F7EF-41F0-B6E5-D7CCCEC6DE3A}\WpadDecisionTime = e099ac4c9fccd801	System.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	System.exe
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{F0960BCE-F7EF-41F0-B6E5-D7CCCEC6DE3A}\WpadDecisionReason = "1"	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5e-e6-6e-72-b9-fc\WpadDecision = "0"	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	System.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	System.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2016	eff4b0ef791434d123670c4729fc88c36786e6f353150d3fa35325832f967330.exe
Token: SeDebugPrivilege	1924	System.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1924	System.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1924 wrote to memory of 1724	1924	System.exe	27
PID 1924 wrote to memory of 1724	1924	System.exe	27
PID 1924 wrote to memory of 1724	1924	System.exe	27
PID 1924 wrote to memory of 1724	1924	System.exe	27

C:\Users\Admin\AppData\Local\Temp\eff4b0ef791434d123670c4729fc88c36786e6f353150d3fa35325832f967330.exe
"C:\Users\Admin\AppData\Local\Temp\eff4b0ef791434d123670c4729fc88c36786e6f353150d3fa35325832f967330.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:2016

C:\Windows\System.exe
C:\Windows\System.exe
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1924
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:1724

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\System.exe

Filesize
631KB

MD5
0e57c551b83cc1c5ae63721fd8eaf4a1

SHA1
e93fe1bbc31984fcb145a4e541630d51dfeaec20

SHA256
eff4b0ef791434d123670c4729fc88c36786e6f353150d3fa35325832f967330

SHA512
7eb583c8486fe204033e6f926ce9652e2b45b9d2715bfba55a5d06afdb845b8ea888cce8109930176d11d103a5985f33ae586f4030de92d5209b6160481f62f8

Download Submit
C:\Windows\System.exe

Filesize
631KB

MD5
0e57c551b83cc1c5ae63721fd8eaf4a1

SHA1
e93fe1bbc31984fcb145a4e541630d51dfeaec20

SHA256
eff4b0ef791434d123670c4729fc88c36786e6f353150d3fa35325832f967330

SHA512
7eb583c8486fe204033e6f926ce9652e2b45b9d2715bfba55a5d06afdb845b8ea888cce8109930176d11d103a5985f33ae586f4030de92d5209b6160481f62f8

Download Submit
memory/1924-63-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/1924-64-0x0000000000670000-0x00000000006C4000-memory.dmp

Filesize
336KB

Download
memory/1924-65-0x0000000003140000-0x0000000003240000-memory.dmp

Filesize
1024KB

Download
memory/1924-66-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2016-54-0x0000000075A71000-0x0000000075A73000-memory.dmp

Filesize
8KB

Download
memory/2016-55-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2016-56-0x0000000000320000-0x0000000000374000-memory.dmp

Filesize
336KB

Download
memory/2016-57-0x0000000003260000-0x0000000003360000-memory.dmp

Filesize
1024KB

Download
memory/2016-61-0x0000000000400000-0x000000000051B000-memory.dmp

Filesize
1.1MB

Download
memory/2016-62-0x0000000000320000-0x0000000000374000-memory.dmp

Filesize
336KB

Download