7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d

Analysis

max time kernel
151s
max time network
127s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
01-10-2022 22:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe
Size

252KB
MD5

78822aae940a2c135440cb5b5224a430
SHA1

4597c56190e8db94070f0ca291f8d8fb1ac69143
SHA256

7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d
SHA512

f98b120f7b085afa44daef15225216ce00e2a1650b602662b92ce579764fe8d4ba8dd45844b19f359eedc43f3afcaed058c5fe411a1101c4e1bfe41ff6b86171
SSDEEP

6144:Lw62llZA3KznkGRcc9HQJO9+W9l46ntsOVqgcVZzr355o:E64lZhznkGRcc5QJrW3TtsOEgcV1r3Lo

Score

8^/10

persistence

Malware Config

Signatures

Executes dropped EXE 2 IoCs

pid	Process
1720	cagu.exe
1952	cagu.exe

Deletes itself 1 IoCs

pid	Process
784	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
1648	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe
1648	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\cagu.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Lafay\\cagu.exe"	explorer.exe
Key created	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\Currentversion\Run	explorer.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 912 set thread context of 1648	912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	28
PID 1720 set thread context of 1952	1720	cagu.exe	30

NTFS ADS 1 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Local\Microsoft\Windows Mail\Local Folders\Inbox\4102228F-00000001.eml:OECustomProperty	WinMail.exe

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe
1720	cagu.exe
1464	explorer.exe
1952	cagu.exe
1952	cagu.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe
1464	explorer.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1648	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe
Token: SeManageVolumePrivilege	1488	WinMail.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1488	WinMail.exe

Suspicious use of SendNotifyMessage 1 IoCs

pid	Process
1488	WinMail.exe

Suspicious use of SetWindowsHookEx 9 IoCs

pid	Process
912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe
912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe
912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe
912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe
1720	cagu.exe
1720	cagu.exe
1720	cagu.exe
1720	cagu.exe
1488	WinMail.exe

Suspicious use of WriteProcessMemory 60 IoCs

description	pid	Process	procid_target
PID 912 wrote to memory of 1648	912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	28
PID 912 wrote to memory of 1648	912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	28
PID 912 wrote to memory of 1648	912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	28
PID 912 wrote to memory of 1648	912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	28
PID 912 wrote to memory of 1648	912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	28
PID 912 wrote to memory of 1648	912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	28
PID 912 wrote to memory of 1648	912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	28
PID 912 wrote to memory of 1648	912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	28
PID 912 wrote to memory of 1648	912	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	28
PID 1648 wrote to memory of 1720	1648	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	29
PID 1648 wrote to memory of 1720	1648	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	29
PID 1648 wrote to memory of 1720	1648	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	29
PID 1648 wrote to memory of 1720	1648	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	29
PID 1720 wrote to memory of 1952	1720	cagu.exe	30
PID 1720 wrote to memory of 1952	1720	cagu.exe	30
PID 1720 wrote to memory of 1952	1720	cagu.exe	30
PID 1720 wrote to memory of 1952	1720	cagu.exe	30
PID 1720 wrote to memory of 1952	1720	cagu.exe	30
PID 1720 wrote to memory of 1952	1720	cagu.exe	30
PID 1720 wrote to memory of 1952	1720	cagu.exe	30
PID 1720 wrote to memory of 1952	1720	cagu.exe	30
PID 1720 wrote to memory of 1952	1720	cagu.exe	30
PID 1648 wrote to memory of 784	1648	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	31
PID 1648 wrote to memory of 784	1648	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	31
PID 1648 wrote to memory of 784	1648	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	31
PID 1648 wrote to memory of 784	1648	7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe	31
PID 1952 wrote to memory of 1464	1952	cagu.exe	33
PID 1952 wrote to memory of 1464	1952	cagu.exe	33
PID 1952 wrote to memory of 1464	1952	cagu.exe	33
PID 1952 wrote to memory of 1464	1952	cagu.exe	33
PID 1952 wrote to memory of 1464	1952	cagu.exe	33
PID 1952 wrote to memory of 1464	1952	cagu.exe	33
PID 1952 wrote to memory of 1464	1952	cagu.exe	33
PID 1952 wrote to memory of 1464	1952	cagu.exe	33
PID 1952 wrote to memory of 1464	1952	cagu.exe	33
PID 1464 wrote to memory of 1128	1464	explorer.exe	18
PID 1464 wrote to memory of 1128	1464	explorer.exe	18
PID 1464 wrote to memory of 1128	1464	explorer.exe	18
PID 1464 wrote to memory of 1128	1464	explorer.exe	18
PID 1464 wrote to memory of 1128	1464	explorer.exe	18
PID 1464 wrote to memory of 1188	1464	explorer.exe	19
PID 1464 wrote to memory of 1188	1464	explorer.exe	19
PID 1464 wrote to memory of 1188	1464	explorer.exe	19
PID 1464 wrote to memory of 1188	1464	explorer.exe	19
PID 1464 wrote to memory of 1188	1464	explorer.exe	19
PID 1464 wrote to memory of 1216	1464	explorer.exe	20
PID 1464 wrote to memory of 1216	1464	explorer.exe	20
PID 1464 wrote to memory of 1216	1464	explorer.exe	20
PID 1464 wrote to memory of 1216	1464	explorer.exe	20
PID 1464 wrote to memory of 1216	1464	explorer.exe	20
PID 1464 wrote to memory of 1952	1464	explorer.exe	30
PID 1464 wrote to memory of 1952	1464	explorer.exe	30
PID 1464 wrote to memory of 1952	1464	explorer.exe	30
PID 1464 wrote to memory of 1952	1464	explorer.exe	30
PID 1464 wrote to memory of 1952	1464	explorer.exe	30
PID 1952 wrote to memory of 1488	1952	cagu.exe	34
PID 1952 wrote to memory of 1488	1952	cagu.exe	34
PID 1952 wrote to memory of 1488	1952	cagu.exe	34
PID 1952 wrote to memory of 1488	1952	cagu.exe	34
PID 1952 wrote to memory of 1488	1952	cagu.exe	34

C:\Windows\system32\taskhost.exe
"taskhost.exe"
1⤵
PID:1128

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1188

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1216
- C:\Users\Admin\AppData\Local\Temp\7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe
  "C:\Users\Admin\AppData\Local\Temp\7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:912
- - C:\Users\Admin\AppData\Local\Temp\7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe
    C:\Users\Admin\AppData\Local\Temp\7227a94dfd88608cf0d9664077631adac2a2f700381b87579019c569fec35c5d.exe
    3⤵
    - Loads dropped DLL
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1648
  - - C:\Users\Admin\AppData\Roaming\Lafay\cagu.exe
      "C:\Users\Admin\AppData\Roaming\Lafay\cagu.exe"
      4⤵
      Executes dropped EXE
      Suspicious use of SetThreadContext
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:1720
    - - C:\Users\Admin\AppData\Roaming\Lafay\cagu.exe
        
        C:\Users\Admin\AppData\Roaming\Lafay\cagu.exe
        5⤵
        Executes dropped EXE
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1952
      - C:\Windows\SysWOW64\explorer.exe
        
        "C:\Windows\SysWOW64\explorer.exe"
        6⤵
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:1464
  - - C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Local\Temp\tmp9e143254.bat"
      4⤵
      Deletes itself
      PID:784

C:\Program Files\Windows Mail\WinMail.exe
"C:\Program Files\Windows Mail\WinMail.exe" -Embedding
1⤵
- NTFS ADS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1488

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\tmp9e143254.bat

Filesize
307B

MD5
0f8877d3d3428b0e578ef1fad7cfae72

SHA1
5b68559740a81f692f833b52dd8b626ef1a21971

SHA256
01aea658a5722fb4e65f0525219d87eba772f1b942b4b48fa674df222c8f762d

SHA512
00938d95113e085af4b7e5129cb91042802a0069b56f9bb433f39559f9b937cb84694ff42f76df422273f9fa81786beba43eb736d7b9831e97e049408d95a471

Download Submit
C:\Users\Admin\AppData\Roaming\Lafay\cagu.exe

Filesize
252KB

MD5
240dbb7238fb23f4bafb5a681fd4c02e

SHA1
9e14281515b1037a1d0c2479fafb2d743bee6ae6

SHA256
280eef0b81666f04616fa4992ddd2ede7f60a51154b397f8d507fafa76eae91d

SHA512
5e7233100155d5b0d3c22f30a1840c5defdde048201119ce87eff854c0b61e81f676954dfd7928008e7021ec89be99350047094f753b0399b7a1131f1db605a5

Download Submit
C:\Users\Admin\AppData\Roaming\Lafay\cagu.exe

Filesize
252KB

MD5
240dbb7238fb23f4bafb5a681fd4c02e

SHA1
9e14281515b1037a1d0c2479fafb2d743bee6ae6

SHA256
280eef0b81666f04616fa4992ddd2ede7f60a51154b397f8d507fafa76eae91d

SHA512
5e7233100155d5b0d3c22f30a1840c5defdde048201119ce87eff854c0b61e81f676954dfd7928008e7021ec89be99350047094f753b0399b7a1131f1db605a5

Download Submit
C:\Users\Admin\AppData\Roaming\Lafay\cagu.exe

Filesize
252KB

MD5
240dbb7238fb23f4bafb5a681fd4c02e

SHA1
9e14281515b1037a1d0c2479fafb2d743bee6ae6

SHA256
280eef0b81666f04616fa4992ddd2ede7f60a51154b397f8d507fafa76eae91d

SHA512
5e7233100155d5b0d3c22f30a1840c5defdde048201119ce87eff854c0b61e81f676954dfd7928008e7021ec89be99350047094f753b0399b7a1131f1db605a5

Download Submit
\Users\Admin\AppData\Roaming\Lafay\cagu.exe

Filesize
252KB

MD5
240dbb7238fb23f4bafb5a681fd4c02e

SHA1
9e14281515b1037a1d0c2479fafb2d743bee6ae6

SHA256
280eef0b81666f04616fa4992ddd2ede7f60a51154b397f8d507fafa76eae91d

SHA512
5e7233100155d5b0d3c22f30a1840c5defdde048201119ce87eff854c0b61e81f676954dfd7928008e7021ec89be99350047094f753b0399b7a1131f1db605a5

Download Submit
\Users\Admin\AppData\Roaming\Lafay\cagu.exe

Filesize
252KB

MD5
240dbb7238fb23f4bafb5a681fd4c02e

SHA1
9e14281515b1037a1d0c2479fafb2d743bee6ae6

SHA256
280eef0b81666f04616fa4992ddd2ede7f60a51154b397f8d507fafa76eae91d

SHA512
5e7233100155d5b0d3c22f30a1840c5defdde048201119ce87eff854c0b61e81f676954dfd7928008e7021ec89be99350047094f753b0399b7a1131f1db605a5

Download Submit
memory/912-54-0x0000000076091000-0x0000000076093000-memory.dmp

Filesize
8KB

Download
memory/912-63-0x0000000000280000-0x0000000000284000-memory.dmp

Filesize
16KB

Download
memory/1128-117-0x0000000001D50000-0x0000000001D87000-memory.dmp

Filesize
220KB

Download
memory/1128-118-0x0000000001D50000-0x0000000001D87000-memory.dmp

Filesize
220KB

Download
memory/1128-116-0x0000000001D50000-0x0000000001D87000-memory.dmp

Filesize
220KB

Download
memory/1128-115-0x0000000001D50000-0x0000000001D87000-memory.dmp

Filesize
220KB

Download
memory/1188-121-0x0000000000130000-0x0000000000167000-memory.dmp

Filesize
220KB

Download
memory/1188-122-0x0000000000130000-0x0000000000167000-memory.dmp

Filesize
220KB

Download
memory/1188-123-0x0000000000130000-0x0000000000167000-memory.dmp

Filesize
220KB

Download
memory/1188-124-0x0000000000130000-0x0000000000167000-memory.dmp

Filesize
220KB

Download
memory/1216-127-0x0000000002A90000-0x0000000002AC7000-memory.dmp

Filesize
220KB

Download
memory/1216-128-0x0000000002A90000-0x0000000002AC7000-memory.dmp

Filesize
220KB

Download
memory/1216-129-0x0000000002A90000-0x0000000002AC7000-memory.dmp

Filesize
220KB

Download
memory/1216-130-0x0000000002A90000-0x0000000002AC7000-memory.dmp

Filesize
220KB

Download
memory/1464-93-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1464-94-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1464-91-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1464-97-0x00000000748F1000-0x00000000748F3000-memory.dmp

Filesize
8KB

Download
memory/1464-106-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1464-145-0x0000000000080000-0x00000000000B7000-memory.dmp

Filesize
220KB

Download
memory/1488-98-0x000007FEFBCA1000-0x000007FEFBCA3000-memory.dmp

Filesize
8KB

Download
memory/1488-99-0x000007FEF6501000-0x000007FEF6503000-memory.dmp

Filesize
8KB

Download
memory/1488-100-0x00000000020E0000-0x00000000020F0000-memory.dmp

Filesize
64KB

Download
memory/1488-107-0x0000000002510000-0x0000000002520000-memory.dmp

Filesize
64KB

Download
memory/1648-56-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1648-59-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1648-55-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1648-67-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1648-66-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1648-61-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1648-58-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1648-86-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1952-133-0x0000000000300000-0x0000000000337000-memory.dmp

Filesize
220KB

Download
memory/1952-134-0x0000000000300000-0x0000000000337000-memory.dmp

Filesize
220KB

Download
memory/1952-137-0x0000000000300000-0x0000000000337000-memory.dmp

Filesize
220KB

Download
memory/1952-144-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download
memory/1952-87-0x0000000000400000-0x0000000000437000-memory.dmp

Filesize
220KB

Download