eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76

Analysis

max time kernel
40s
max time network
45s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
03-10-2022 17:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
Size

207KB
MD5

03de7d8b714907f4bc447832935ddea0
SHA1

0dd3768cfafde4046038acb17c03addafd147f65
SHA256

eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76
SHA512

dae7cddbffc5e70c040bf68173da11f110b65894e08154b57421a5dcee687ba3d455a85225cf5ae06f8d75efe301fa2413203b3a72e5dacdc88e7a8dd65cc5a8
SSDEEP

3072:0rGZELOILGHI0PJ9J4OSuMpCkQ/D+Vm/KjMBt:HZELOPHHkO7YrQiV1q

Score

10^/10

evasion trojan

Malware Config

Signatures

UAC bypass 3 TTPs 3 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0"	DllHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0"	DllHost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	DllHost.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe

Suspicious behavior: MapViewOfSection 21 IoCs

pid	Process
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1060	DllHost.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 968 wrote to memory of 372	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	5
PID 968 wrote to memory of 372	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	5
PID 968 wrote to memory of 372	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	5
PID 968 wrote to memory of 372	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	5
PID 968 wrote to memory of 372	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	5
PID 968 wrote to memory of 372	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	5
PID 968 wrote to memory of 372	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	5
PID 968 wrote to memory of 384	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	4
PID 968 wrote to memory of 384	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	4
PID 968 wrote to memory of 384	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	4
PID 968 wrote to memory of 384	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	4
PID 968 wrote to memory of 384	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	4
PID 968 wrote to memory of 384	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	4
PID 968 wrote to memory of 384	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	4
PID 968 wrote to memory of 420	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	3
PID 968 wrote to memory of 420	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	3
PID 968 wrote to memory of 420	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	3
PID 968 wrote to memory of 420	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	3
PID 968 wrote to memory of 420	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	3
PID 968 wrote to memory of 420	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	3
PID 968 wrote to memory of 420	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	3
PID 968 wrote to memory of 464	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	2
PID 968 wrote to memory of 464	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	2
PID 968 wrote to memory of 464	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	2
PID 968 wrote to memory of 464	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	2
PID 968 wrote to memory of 464	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	2
PID 968 wrote to memory of 464	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	2
PID 968 wrote to memory of 464	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	2
PID 968 wrote to memory of 480	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	1
PID 968 wrote to memory of 480	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	1
PID 968 wrote to memory of 480	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	1
PID 968 wrote to memory of 480	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	1
PID 968 wrote to memory of 480	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	1
PID 968 wrote to memory of 480	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	1
PID 968 wrote to memory of 480	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	1
PID 968 wrote to memory of 488	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	26
PID 968 wrote to memory of 488	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	26
PID 968 wrote to memory of 488	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	26
PID 968 wrote to memory of 488	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	26
PID 968 wrote to memory of 488	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	26
PID 968 wrote to memory of 488	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	26
PID 968 wrote to memory of 488	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	26
PID 968 wrote to memory of 596	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	25
PID 968 wrote to memory of 596	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	25
PID 968 wrote to memory of 596	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	25
PID 968 wrote to memory of 596	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	25
PID 968 wrote to memory of 596	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	25
PID 968 wrote to memory of 596	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	25
PID 968 wrote to memory of 596	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	25
PID 968 wrote to memory of 672	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	24
PID 968 wrote to memory of 672	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	24
PID 968 wrote to memory of 672	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	24
PID 968 wrote to memory of 672	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	24
PID 968 wrote to memory of 672	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	24
PID 968 wrote to memory of 672	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	24
PID 968 wrote to memory of 672	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	24
PID 968 wrote to memory of 744	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	23
PID 968 wrote to memory of 744	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	23
PID 968 wrote to memory of 744	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	23
PID 968 wrote to memory of 744	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	23
PID 968 wrote to memory of 744	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	23
PID 968 wrote to memory of 744	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	23
PID 968 wrote to memory of 744	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	23
PID 968 wrote to memory of 808	968	eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe	22

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:480

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:464
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:872
- - \\?\C:\Windows\system32\wbem\WMIADAP.EXE
    wmiadap.exe /F /T /R
    3⤵
    PID:1644
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:1560
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:896
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1224
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1048
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:304
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:324
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:848
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:808
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:744
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:672
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:596
- - C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{EA2C6B24-C590-457B-BAC8-4A0F9B13B5B8}
    3⤵
    - UAC bypass
    - Suspicious use of FindShellTrayWindow
    PID:1060
- - C:\Windows\SysWOW64\DllHost.exe
    C:\Windows\SysWOW64\DllHost.exe /Processid:{06C792F8-6212-4F39-BF70-E8C0AC965C23}
    3⤵
    PID:2036
  - - C:\Windows\SysWOW64\UserAccountControlSettings.exe
      "C:\Windows\system32\UserAccountControlSettings.exe" /applySettings
      4⤵
      PID:1716

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:420

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:384

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:372
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:488

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1380
- C:\Users\Admin\AppData\Local\Temp\eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe
  "C:\Users\Admin\AppData\Local\Temp\eec2ce89af284197802928c9b825405cb412b2de2ae1d95599a2f2315be86b76.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:968

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1312

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/968-54-0x0000000076831000-0x0000000076833000-memory.dmp

Filesize
8KB

Download
memory/968-55-0x0000000001000000-0x0000000001037000-memory.dmp

Filesize
220KB

Download
memory/1716-58-0x0000000000000000-mapping.dmp

Download