Analysis

  • max time kernel
    135s
  • max time network
    153s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    02-10-2022 12:42

General

  • Target

    9f7844be03791719ff671023585761943156d660578fb668fd9435172917842f.exe

  • Size

    198KB

  • MD5

    6c20a60983f8584c65566ebee3e86ad4

  • SHA1

    cdaccfd98c85548a53d4d04de2ef2e0024a97c52

  • SHA256

    9f7844be03791719ff671023585761943156d660578fb668fd9435172917842f

  • SHA512

    29bfe8ccdbc4b2f66c3ee48e66c848ccda518a57f2dc57729e19ef646825031ece01f10883a0c036cb4f829079896245a4ded2963385763e97f1c10ddadf31fa

  • SSDEEP

    3072:EDUOX1Mmh3gC3504c66i7c3Dwsvi6h58/eiYo/OlKvx0jpfqIlOv2DDRrs+eq:Y9X1R53q4zX7c3Dwsa6ef38fqmzt

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Registers COM server for autorun 1 TTPs 4 IoCs
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 9 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Modifies registry class 6 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
    • Executes dropped EXE
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:464
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1284
    • C:\Users\Admin\AppData\Local\Temp\9f7844be03791719ff671023585761943156d660578fb668fd9435172917842f.exe
      "C:\Users\Admin\AppData\Local\Temp\9f7844be03791719ff671023585761943156d660578fb668fd9435172917842f.exe"
      2⤵
      • Registers COM server for autorun
      • Suspicious use of SetThreadContext
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1380
      • C:\Windows\SysWOW64\cmd.exe
        "C:\Windows\system32\cmd.exe"
        3⤵
        • Deletes itself
        PID:804

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\$Recycle.Bin\S-1-5-18\$d4e37f8e5af09b64e86d0830097e992e\@

    Filesize

    2KB

    MD5

    cfb0990c9e934eec567031ece298c747

    SHA1

    b9d693120239551cf0107dd48d04f162d2fd4f0f

    SHA256

    644c2e1efeb903c58dd03437edff78e543a62febc4bd5768ca48c86fcda64fd1

    SHA512

    421a67362b4daffd942b2207375616e27c2b1c2d420047726480d497fca2a8d39cbec1b1931dd55bf86cbdd6dee284bea0a40a704bdb483d9c382a4ebc5401b8

  • C:\$Recycle.Bin\S-1-5-18\$d4e37f8e5af09b64e86d0830097e992e\n

    Filesize

    41KB

    MD5

    fb4e3236959152a057bc6b7603c538ef

    SHA1

    b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

    SHA256

    8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

    SHA512

    993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

  • C:\$Recycle.Bin\S-1-5-21-4063495947-34355257-727531523-1000\$d4e37f8e5af09b64e86d0830097e992e\n

    Filesize

    41KB

    MD5

    fb4e3236959152a057bc6b7603c538ef

    SHA1

    b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

    SHA256

    8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

    SHA512

    993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

  • \$Recycle.Bin\S-1-5-18\$d4e37f8e5af09b64e86d0830097e992e\n

    Filesize

    41KB

    MD5

    fb4e3236959152a057bc6b7603c538ef

    SHA1

    b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

    SHA256

    8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

    SHA512

    993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

  • \$Recycle.Bin\S-1-5-21-4063495947-34355257-727531523-1000\$d4e37f8e5af09b64e86d0830097e992e\n

    Filesize

    41KB

    MD5

    fb4e3236959152a057bc6b7603c538ef

    SHA1

    b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

    SHA256

    8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

    SHA512

    993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

  • memory/804-61-0x0000000000000000-mapping.dmp

  • memory/1380-59-0x0000000000230000-0x0000000000266000-memory.dmp

    Filesize

    216KB

  • memory/1380-58-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB

  • memory/1380-62-0x0000000000400000-0x0000000000436000-memory.dmp

    Filesize

    216KB