Analysis
-
max time kernel
32s -
max time network
43s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 23:24
Static task
static1
Behavioral task
behavioral1
Sample
7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Resource
win10v2004-20220812-en
General
-
Target
7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
-
Size
18KB
-
MD5
03ff129b5a1f629fac1497a5f859bfb7
-
SHA1
6bdeb12a0039316d2105880674cc97466c349ce2
-
SHA256
7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72
-
SHA512
c95584379f30e5f2c3f01eb53f752dc75ae0dc89e6741ba3bcc76decedbd928bc3a4ba0a6eb359b65d18a6916668808a87751f2cbf3298db5144d5ff2af2ddf2
-
SSDEEP
384:CazBeM/j1SqyM0DNpa/WigJqmkdSVhJCcxLg1p+6HGbY:reM/jc5M+fMWvhbVqctg3mbY
Malware Config
Signatures
-
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\¤„Ðn.dll 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe File created C:\Windows\SysWOW64\tf0 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe File opened for modification C:\Windows\SysWOW64\¤„Ðn.dll.LoG 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe -
Modifies registry class 12 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS\ 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\ 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\InProcServer32\ = "C:\\Windows\\SysWow64\\¤„Ð\u0090\x10n.dll" 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\InProcServer32\ThreadingModel = "Apartment" 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\ = "MICROSOFT" 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\InProcServer32 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 576 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 576 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Token: SeRestorePrivilege 576 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Token: SeBackupPrivilege 576 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe Token: SeRestorePrivilege 576 7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe"C:\Users\Admin\AppData\Local\Temp\7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe"1⤵
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:576