Analysis
- max time kernel
150s - max time network
140s - platform
windows10-2004_x64 - resource
win10v2004-20220901-en - resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system - submitted
03/10/2022, 22:18
Behavioral task
behavioral1
Sample
561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe
Resource
win7-20220901-en
windows7-x64
6 signatures
150 seconds
General
- Target 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe
- Size 429KB
- Sample221003-18d91ahhe5
- SHA256 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d
- MD5 2a24c0724ba86dafb5036bc0635a64a7
- SHA1 b8da319731a3eb4ddc3c66755b022a48e37f569e
- SHA512 f6d9a93fb0544ae035c22f69201491646f6d1b7d23708812e4f05ee090367b9b584037da37bf923aafe95798405c95b5885888de37ce65247d577a71b994b273
- SSDEEP 12288:XHq7DumEtQvtk8+nJ1SePycjc0u4Nzzkd9gYV:XHUaCD+J1hPrjc0uAze
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
-
resource yara_rule behavioral2/memory/3360-135-0x0000000000400000-0x00000000004C8000-memory.dmp upx behavioral2/memory/3360-136-0x0000000000400000-0x00000000004C8000-memory.dmp upx behavioral2/memory/3404-138-0x0000000000400000-0x000000000052E000-memory.dmp upx behavioral2/memory/3360-137-0x0000000000400000-0x00000000004C8000-memory.dmp upx behavioral2/memory/3360-139-0x0000000000400000-0x00000000004C8000-memory.dmp upx behavioral2/memory/3360-140-0x0000000000400000-0x00000000004C8000-memory.dmp upx - Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 3404 set thread context of 3360 3404 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 84 PID 3360 set thread context of 2108 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 86 PID 2108 set thread context of 5084 2108 iexplore.exe 87 - Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeSecurityPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeTakeOwnershipPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeLoadDriverPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeSystemProfilePrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeSystemtimePrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeProfSingleProcessPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeIncBasePriorityPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeCreatePagefilePrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeBackupPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeRestorePrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeShutdownPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeDebugPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeSystemEnvironmentPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeChangeNotifyPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeRemoteShutdownPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeUndockPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeManageVolumePrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeImpersonatePrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeCreateGlobalPrivilege 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: 33 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: 34 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: 35 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: 36 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe Token: SeIncreaseQuotaPrivilege 5084 iexplore.exe Token: SeSecurityPrivilege 5084 iexplore.exe Token: SeTakeOwnershipPrivilege 5084 iexplore.exe Token: SeLoadDriverPrivilege 5084 iexplore.exe Token: SeSystemProfilePrivilege 5084 iexplore.exe Token: SeSystemtimePrivilege 5084 iexplore.exe Token: SeProfSingleProcessPrivilege 5084 iexplore.exe Token: SeIncBasePriorityPrivilege 5084 iexplore.exe Token: SeCreatePagefilePrivilege 5084 iexplore.exe Token: SeBackupPrivilege 5084 iexplore.exe Token: SeRestorePrivilege 5084 iexplore.exe Token: SeShutdownPrivilege 5084 iexplore.exe Token: SeDebugPrivilege 5084 iexplore.exe Token: SeSystemEnvironmentPrivilege 5084 iexplore.exe Token: SeChangeNotifyPrivilege 5084 iexplore.exe Token: SeRemoteShutdownPrivilege 5084 iexplore.exe Token: SeUndockPrivilege 5084 iexplore.exe Token: SeManageVolumePrivilege 5084 iexplore.exe Token: SeImpersonatePrivilege 5084 iexplore.exe Token: SeCreateGlobalPrivilege 5084 iexplore.exe Token: 33 5084 iexplore.exe Token: 34 5084 iexplore.exe Token: 35 5084 iexplore.exe Token: 36 5084 iexplore.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3404 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 2108 iexplore.exe 5084 iexplore.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 3404 wrote to memory of 3360 3404 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 84 PID 3404 wrote to memory of 3360 3404 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 84 PID 3404 wrote to memory of 3360 3404 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 84 PID 3404 wrote to memory of 3360 3404 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 84 PID 3404 wrote to memory of 3360 3404 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 84 PID 3404 wrote to memory of 3360 3404 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 84 PID 3404 wrote to memory of 3360 3404 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 84 PID 3404 wrote to memory of 3360 3404 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 84 PID 3360 wrote to memory of 2108 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 86 PID 3360 wrote to memory of 2108 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 86 PID 3360 wrote to memory of 2108 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 86 PID 3360 wrote to memory of 2108 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 86 PID 3360 wrote to memory of 2108 3360 561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe 86 PID 2108 wrote to memory of 5084 2108 iexplore.exe 87 PID 2108 wrote to memory of 5084 2108 iexplore.exe 87 PID 2108 wrote to memory of 5084 2108 iexplore.exe 87 PID 2108 wrote to memory of 5084 2108 iexplore.exe 87 PID 2108 wrote to memory of 5084 2108 iexplore.exe 87 PID 2108 wrote to memory of 5084 2108 iexplore.exe 87 PID 2108 wrote to memory of 5084 2108 iexplore.exe 87 PID 2108 wrote to memory of 5084 2108 iexplore.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe"C:\Users\Admin\AppData\Local\Temp\561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3404 -
C:\Users\Admin\AppData\Local\Temp\561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe"C:\Users\Admin\AppData\Local\Temp\561e1f97a858ddb4e39a32f733d3d13ebdf7ec35fa0579838bbefb4ca2bc8e9d.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3360 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2108 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:5084
-
-
-