Analysis
-
max time kernel
152s -
max time network
100s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 01:48
Static task
static1
Behavioral task
behavioral1
Sample
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe
Resource
win7-20220812-en
General
-
Target
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe
-
Size
470KB
-
MD5
15a861b54403084db2cfabc2f7e0dd40
-
SHA1
6498b6fc584cc8af7265874b8bd9af77218760fb
-
SHA256
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02
-
SHA512
6532568dd8fb03ac5573ece2019cac67eafbb4f51b50a56cd87976a92a06f3350c31043c7e08ab5049487e37bd7ee45a84e158867ddd0f271b73ba662010e80c
-
SSDEEP
6144:+8SRDa8qLzrqUeQfHR2sle1tgk25MBqpp6joQ68SRDa8qLzrqUeQfHR2sle1tgkm:EPKrnsrkOBqdPKrnsrkOBqp
Malware Config
Signatures
-
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Adds Run key to start application 2 TTPs 8 IoCs
Processes:
REG.exeREG.exeREG.exeREG.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run REG.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\chrome . exe = "C:\\Users\\Admin\\AppData\\Roaming\\sub folder\\google chrome.exe" REG.exe -
Runs ping.exe 1 TTPs 10 IoCs
Processes:
ping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exeping.exepid process 304 ping.exe 776 ping.exe 1684 ping.exe 1912 ping.exe 652 ping.exe 1868 ping.exe 1796 ping.exe 1620 ping.exe 1424 ping.exe 732 ping.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exepid process 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exedescription pid process Token: SeDebugPrivilege 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exedescription pid process target process PID 1736 wrote to memory of 604 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 1736 wrote to memory of 604 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 1736 wrote to memory of 604 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 1736 wrote to memory of 604 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 1736 wrote to memory of 604 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 1736 wrote to memory of 604 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 1736 wrote to memory of 604 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe RegAsm.exe PID 1736 wrote to memory of 1676 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe attrib.exe PID 1736 wrote to memory of 1676 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe attrib.exe PID 1736 wrote to memory of 1676 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe attrib.exe PID 1736 wrote to memory of 1676 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe attrib.exe PID 1736 wrote to memory of 1424 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1424 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1424 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1424 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1912 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1912 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1912 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1912 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 652 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 652 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 652 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 652 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 304 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 304 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 304 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 304 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 732 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 732 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 732 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 732 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 776 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 776 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 776 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 776 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1868 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1868 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1868 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1868 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1796 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1796 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1796 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1796 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1684 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1684 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1684 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1684 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1620 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1620 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1620 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1620 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe ping.exe PID 1736 wrote to memory of 1164 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1164 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1164 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1164 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1652 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1652 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1652 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1652 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1636 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1636 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1636 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1636 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe PID 1736 wrote to memory of 1784 1736 7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe REG.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe"C:\Users\Admin\AppData\Local\Temp\7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
-
C:\Windows\SysWOW64\attrib.exe"C:\Windows\System32\attrib.exe" +s +h C:\Users\Admin\AppData\Local\Temp\7f78edb4342a13fb5534588c49b0ab64e67026b627accedadee2a92473437a02.exe2⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\ping.exeC:\Windows\System32\ping.exe google.com2⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\REG.exeREG ADD "HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run" /V "chrome . exe" /t REG_SZ /F /D "C:\Users\Admin\AppData\Roaming\sub folder\google chrome.exe2⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/304-61-0x0000000000000000-mapping.dmp
-
memory/652-60-0x0000000000000000-mapping.dmp
-
memory/732-62-0x0000000000000000-mapping.dmp
-
memory/776-63-0x0000000000000000-mapping.dmp
-
memory/1164-68-0x0000000000000000-mapping.dmp
-
memory/1424-58-0x0000000000000000-mapping.dmp
-
memory/1620-67-0x0000000000000000-mapping.dmp
-
memory/1636-70-0x0000000000000000-mapping.dmp
-
memory/1652-69-0x0000000000000000-mapping.dmp
-
memory/1676-57-0x0000000000000000-mapping.dmp
-
memory/1684-66-0x0000000000000000-mapping.dmp
-
memory/1736-54-0x0000000076411000-0x0000000076413000-memory.dmpFilesize
8KB
-
memory/1736-56-0x0000000074970000-0x0000000074F1B000-memory.dmpFilesize
5.7MB
-
memory/1736-55-0x0000000074970000-0x0000000074F1B000-memory.dmpFilesize
5.7MB
-
memory/1784-71-0x0000000000000000-mapping.dmp
-
memory/1796-65-0x0000000000000000-mapping.dmp
-
memory/1868-64-0x0000000000000000-mapping.dmp
-
memory/1912-59-0x0000000000000000-mapping.dmp