Analysis
-
max time kernel
152s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/10/2022, 12:49
Static task
static1
Behavioral task
behavioral1
Sample
944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
13 signatures
150 seconds
General
-
Target
944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe
-
Size
373KB
-
MD5
662acf767ff4897711163ab30b0189e0
-
SHA1
ff4cce09feffa12634cdf0148bf01b2d78427da8
-
SHA256
944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2
-
SHA512
2a46d3c7b30d2fc0776c27a8ddf1266b0823fc00a7fef6b6d345acf71adbd243abb15e01c994e0c7bdb1ff50674023127fb22a1def3413cf0bf03413e45f46dc
-
SSDEEP
6144:b4qJnkP+6bfbSxbSxbSAy1w5Kw5sy1w5Kw5sy/y/yibSxbSj:bw+Aee1yS5Z5syS5Z5sy/y/y8eu
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe," 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe -
ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x0006000000022e0f-144.dat acprotect behavioral2/memory/2708-145-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/2708-146-0x0000000010000000-0x000000001010B000-memory.dmp acprotect -
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\spools.exe 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe File created C:\Windows\SysWOW64\drivers\spools.exe 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe -
resource yara_rule behavioral2/files/0x0006000000022e0f-144.dat upx behavioral2/memory/2708-145-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/2708-146-0x0000000010000000-0x000000001010B000-memory.dmp upx -
Loads dropped DLL 1 IoCs
pid Process 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe -
Installs/modifies Browser Helper Object 2 TTPs 3 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{1FD49718-1D00-4B19-AF5F-070AF6D5D54C} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{31D09BA0-12F5-4CCE-BE8A-2923E76605DA} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects reg.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe" 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftpdll.dll 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3180 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 3000 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2708 wrote to memory of 1884 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 84 PID 2708 wrote to memory of 1884 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 84 PID 2708 wrote to memory of 1884 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 84 PID 2708 wrote to memory of 3180 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 87 PID 2708 wrote to memory of 3180 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 87 PID 2708 wrote to memory of 3180 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 87 PID 1884 wrote to memory of 3000 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 89 PID 1884 wrote to memory of 3000 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 89 PID 1884 wrote to memory of 3000 1884 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 89 PID 2708 wrote to memory of 224 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 91 PID 2708 wrote to memory of 224 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 91 PID 2708 wrote to memory of 224 2708 944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe"C:\Users\Admin\AppData\Local\Temp\944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Users\Admin\AppData\Local\Temp\944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exeC:\Users\Admin\AppData\Local\Temp\944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Temp\944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exeC:\Users\Admin\AppData\Local\Temp\944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe3⤵
- Suspicious behavior: EnumeratesProcesses
PID:3000
-
-
-
C:\Users\Admin\AppData\Local\Temp\944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exeC:\Users\Admin\AppData\Local\Temp\944cb7b60f62fc1ba4d4364f7b384fd074a9178fc6810f9d0b25897d128493d2.exe2⤵
- Suspicious behavior: EnumeratesProcesses
PID:3180
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f2⤵
- Installs/modifies Browser Helper Object
PID:224
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
5KB
MD591d31d186f3bbd935946697f8b34d5a0
SHA178eccbde63c6913759adf819622ebc3508840f94
SHA2561767b9108ac9ba4e5d0a7bb104a3462ec4dd5076d3245ad58d25fd1a972fecd0
SHA51216bdd3bbf2f51b585617a9d398ce1fa8b997e8dbb92ca2d441cab833733255d364537f1ecf9fa020014af759dc6baf4e1f60bfcdb510062c9ecb01ac64c05db4