7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72

Analysis

max time kernel
120s
max time network
158s
platform
windows10-2004_x64
resource
win10v2004-20220812-en
resource tags

arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
submitted
03/10/2022, 23:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Size

18KB
MD5

03ff129b5a1f629fac1497a5f859bfb7
SHA1

6bdeb12a0039316d2105880674cc97466c349ce2
SHA256

7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72
SHA512

c95584379f30e5f2c3f01eb53f752dc75ae0dc89e6741ba3bcc76decedbd928bc3a4ba0a6eb359b65d18a6916668808a87751f2cbf3298db5144d5ff2af2ddf2
SSDEEP

384:CazBeM/j1SqyM0DNpa/WigJqmkdSVhJCcxLg1p+6HGbY:reM/jc5M+fMWvhbVqctg3mbY

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 2 IoCs

pid	Process
2744	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
2744	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\¤„Ðøn.dll	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
File created	C:\Windows\SysWOW64\tf0	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
File opened for modification	C:\Windows\SysWOW64\¤„Ðøn.dll.LoG	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe

Modifies registry class 13 IoCs

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\ = "MICROSOFT"	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\InProcServer32\ = "C:\\Windows\\SysWow64\\¤„Ð\u0090øn.dll"	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\InProcServer32\ThreadingModel = "Apartment"	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS\	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\\InProcServer32	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\Microsoft\WINDOWS	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
2744	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
2744	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2744	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Token: SeRestorePrivilege	2744	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Token: SeBackupPrivilege	2744	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
Token: SeRestorePrivilege	2744	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2744	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
2744	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
2744	7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe

C:\Users\Admin\AppData\Local\Temp\7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe
"C:\Users\Admin\AppData\Local\Temp\7bfb2dd118646a6b6f0a1e6c527bcc275b1c7b5104f6194596a82026e6e5ed72.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\SysWOW64\¤„Ðøn.dll

Filesize
220KB

MD5
7e3da1a9e337ebc7d01d3d5de6daa8a1

SHA1
25e57e519bd933d459c543a4c82e1cdb521358af

SHA256
c60f925acb56c716565e571d018ccc8d3d4e8c80940db0eab2fc9541f4649f77

SHA512
5890c95b2cfdf145cffe4d08cfae9b5e722f2b7692db498c96a5caad14709568dff1f128b323042a848d78bd5e9b5d9ec21e662ebb221f6bb069b72ae82a747a

Download Submit
C:\Windows\SysWOW64\¤„Ðøn.dll

Filesize
220KB

MD5
7e3da1a9e337ebc7d01d3d5de6daa8a1

SHA1
25e57e519bd933d459c543a4c82e1cdb521358af

SHA256
c60f925acb56c716565e571d018ccc8d3d4e8c80940db0eab2fc9541f4649f77

SHA512
5890c95b2cfdf145cffe4d08cfae9b5e722f2b7692db498c96a5caad14709568dff1f128b323042a848d78bd5e9b5d9ec21e662ebb221f6bb069b72ae82a747a

Download Submit
memory/2744-134-0x0000000000570000-0x000000000057D000-memory.dmp

Filesize
52KB

Download