Analysis
-
max time kernel
152s -
max time network
103s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 13:37
Static task
static1
Behavioral task
behavioral1
Sample
c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe
Resource
win10v2004-20220901-en
General
-
Target
c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe
-
Size
909KB
-
MD5
49d7aa485f5bc619fab70018135fe746
-
SHA1
35d6bc56d95159fa0b2052d3476433c4eb44915b
-
SHA256
c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639
-
SHA512
30c7d79ff9000b55f300a0cef99433f11cdd2468903ae9892f482c0224891a9eca8cf0cec03b23889488c95e0ef74d686d65622c71f6a89321d50c925b22f8a8
-
SSDEEP
3072:ngv9bqpaMausTDYBh7SYmdULiiLnEKhf0TTE5jk/RtRlHAkAtzfKtLy8YFqhctm5:KZu5Zh7ydGnEIjagkAtzuNcdtxEUvLIT
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Mxef = "C:\\Windows\\SysWOW64\\mfc1405.exe" c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe -
Executes dropped EXE 1 IoCs
pid Process 1664 mfc1405.exe -
resource yara_rule behavioral1/memory/288-56-0x0000000000340000-0x00000000003F1000-memory.dmp upx behavioral1/memory/288-59-0x0000000000340000-0x00000000003F1000-memory.dmp upx behavioral1/memory/288-60-0x0000000000340000-0x00000000003F1000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe -
Deletes itself 1 IoCs
pid Process 760 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\mfc1405.exe c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe File opened for modification C:\Windows\SysWOW64\mfc1405.exe c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe 1664 mfc1405.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe Token: SeDebugPrivilege 1664 mfc1405.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 288 wrote to memory of 1664 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 27 PID 288 wrote to memory of 1664 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 27 PID 288 wrote to memory of 1664 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 27 PID 288 wrote to memory of 1664 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 27 PID 288 wrote to memory of 760 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 29 PID 288 wrote to memory of 760 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 29 PID 288 wrote to memory of 760 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 29 PID 288 wrote to memory of 760 288 c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe"C:\Users\Admin\AppData\Local\Temp\c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe"1⤵
- Adds policy Run key to start application
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Windows\SysWOW64\mfc1405.exeC:\Windows\SysWOW64\mfc1405.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1664
-
-
C:\Windows\SysWOW64\cmd.exe/c C:\Users\Admin\AppData\Local\Temp\~unins7816.bat "C:\Users\Admin\AppData\Local\Temp\c2c12f037eaed386f44de67d0aa4a6c9ebce4cf884f51711f5774d630f59b639.exe"2⤵
- Deletes itself
PID:760
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49B
MD59e0a2f5ab30517809b95a1ff1dd98c53
SHA15c1eefdf10e67d1e9216e2e3f5e92352d583c9ce
SHA25697ac9fee75a1f7b63b3115e9c4fb9dda80b1caba26d2fb51325670dee261fe32
SHA512e959cc1fd48fb1cccf135a697924c775a3812bab211fc7f9b00c5a9d617261d84c5d6f7cb548774c1e8f46811b06ca39c5603d0e10cbcb7b805f9abbe49b9b42
-
Filesize
206KB
MD50633dd2a884c269c44bc15458ab6ecd8
SHA1b8438f681dd9a0d3a20e84c364274b085d403cea
SHA256ea6b9e7925f4b5795c3528878726eb5317c19744a0b9ab8e7572511f0b111240
SHA51276ec99b2734bc66b3b5cd4662de7acfd5d8ab80e5e9cbbd91a3eed748ea71c5e5de94ff6cbe44bdb86af8d4659df4eecaed4c5d553d0a79a9d6a5e5bc17c3f9b
-
Filesize
206KB
MD50633dd2a884c269c44bc15458ab6ecd8
SHA1b8438f681dd9a0d3a20e84c364274b085d403cea
SHA256ea6b9e7925f4b5795c3528878726eb5317c19744a0b9ab8e7572511f0b111240
SHA51276ec99b2734bc66b3b5cd4662de7acfd5d8ab80e5e9cbbd91a3eed748ea71c5e5de94ff6cbe44bdb86af8d4659df4eecaed4c5d553d0a79a9d6a5e5bc17c3f9b
-
Filesize
206KB
MD50633dd2a884c269c44bc15458ab6ecd8
SHA1b8438f681dd9a0d3a20e84c364274b085d403cea
SHA256ea6b9e7925f4b5795c3528878726eb5317c19744a0b9ab8e7572511f0b111240
SHA51276ec99b2734bc66b3b5cd4662de7acfd5d8ab80e5e9cbbd91a3eed748ea71c5e5de94ff6cbe44bdb86af8d4659df4eecaed4c5d553d0a79a9d6a5e5bc17c3f9b