Analysis
-
max time kernel
148s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 23:31
Static task
static1
Behavioral task
behavioral1
Sample
4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
General
-
Target
4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe
-
Size
1.4MB
-
MD5
41567638ed986e800ede778a0d121b30
-
SHA1
9cc68d2a46eace0644ccb9b42ed1ba22ed7f4a77
-
SHA256
4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b
-
SHA512
90c94a7ff68482833dbe3e6707f76c4ae0aafd2f97ef8736f3a2f1240672dcfebe0de7ed542d2cc08a9fbaf30a693d350802f5b34960979b889f48ecd7e8eea0
-
SSDEEP
24576:rNmF/mnBoDM5f7F2hQHhToIzdF9s8kwWcMXixJH9GSG+VLUx3GHE07p:rYVZo5TchQBvj9tWXaJHkMLhkSp
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 3208 ms.exe -
Possible privilege escalation attempt 2 IoCs
pid Process 1816 icacls.exe 4924 takeown.exe -
Modifies file permissions 1 TTPs 2 IoCs
pid Process 4924 takeown.exe 1816 icacls.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification C:\Windows\yre.tmp 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe File opened for modification C:\WINDOWS\Bef.tmp 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeTakeOwnershipPrivilege 4924 takeown.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3208 ms.exe 3208 ms.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 2264 wrote to memory of 3208 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 82 PID 2264 wrote to memory of 3208 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 82 PID 2264 wrote to memory of 3208 2264 4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe 82 PID 3208 wrote to memory of 4924 3208 ms.exe 83 PID 3208 wrote to memory of 4924 3208 ms.exe 83 PID 3208 wrote to memory of 1816 3208 ms.exe 85 PID 3208 wrote to memory of 1816 3208 ms.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe"C:\Users\Admin\AppData\Local\Temp\4500f8d91c1e1e888064d93818db065eb5189c0d9bb8640acd5a0639059d4d9b.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Users\Admin\AppData\Local\Temp\ms.exeC:\Users\Admin\AppData\Local\Temp\ms.exe k2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3208 -
C:\Windows\SYSTEM32\takeown.exetakeown /f "C:\WINDOWS\system32\Sens.dll"3⤵
- Possible privilege escalation attempt
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:4924
-
-
C:\Windows\SYSTEM32\icacls.exeicacls "C:\WINDOWS\system32\Sens.dll" /grant administrators:F3⤵
- Possible privilege escalation attempt
- Modifies file permissions
PID:1816
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
424KB
MD5224ee144eb388979711b9c37411418c4
SHA14537031b414f1ce14182076996d72aaf710710be
SHA256d51dfedf88f777136ce1fcbba8c82e11440cf91d1baa278727f708d5c90f1253
SHA512cecc6f7ab9a61db2fdd5c6d1df2b24920f960968ff7318d4fa5da5d20bbdab023a5d8a8f5ca5f19f87d48cb15c4fb373dde0fef724f0b2fca208954894c3780d
-
Filesize
424KB
MD5224ee144eb388979711b9c37411418c4
SHA14537031b414f1ce14182076996d72aaf710710be
SHA256d51dfedf88f777136ce1fcbba8c82e11440cf91d1baa278727f708d5c90f1253
SHA512cecc6f7ab9a61db2fdd5c6d1df2b24920f960968ff7318d4fa5da5d20bbdab023a5d8a8f5ca5f19f87d48cb15c4fb373dde0fef724f0b2fca208954894c3780d