Analysis
-
max time kernel
50s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-10-2022 18:23
Behavioral task
behavioral1
Sample
7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe
Resource
win7-20220812-en
General
-
Target
7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe
-
Size
387KB
-
MD5
e1c8948ea356bec111a2bf64915a7b66
-
SHA1
f112d95e89ec456bedb91212b2b4d89cfb581a91
-
SHA256
7dc1613ec3822d75a3c21649a34152dc7fcabaa96d203173003105d29373175f
-
SHA512
78838844b046f82247e0ab3f1e2342b3b13ca2c58c71f44878ec7bebcc93bc3abc4ddb7e84c68df285a2920b275f0ca8bac16923e9be0531209fc4558964d540
-
SSDEEP
6144:DLV6Bta6dtJmakIM5jNFcD3wdG+RTTCzG21FpYE:DLV6BtpmkWcD3mRTOvFf
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\UDP Service = "C:\\Program Files (x86)\\UDP Service\\udpsv.exe" 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe -
Processes:
7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe -
Drops file in Program Files directory 2 IoCs
Processes:
7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exedescription ioc process File opened for modification C:\Program Files (x86)\UDP Service\udpsv.exe 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe File created C:\Program Files (x86)\UDP Service\udpsv.exe 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 1500 schtasks.exe 1520 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exepid process 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exepid process 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exedescription pid process Token: SeDebugPrivilege 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exedescription pid process target process PID 1720 wrote to memory of 1520 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe schtasks.exe PID 1720 wrote to memory of 1520 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe schtasks.exe PID 1720 wrote to memory of 1520 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe schtasks.exe PID 1720 wrote to memory of 1520 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe schtasks.exe PID 1720 wrote to memory of 1500 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe schtasks.exe PID 1720 wrote to memory of 1500 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe schtasks.exe PID 1720 wrote to memory of 1500 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe schtasks.exe PID 1720 wrote to memory of 1500 1720 7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe"C:\Users\Admin\AppData\Local\Temp\7DC1613EC3822D75A3C21649A34152DC7FCABAA96D203.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp540A.tmp"2⤵
- Creates scheduled task(s)
PID:1520 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "UDP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp5BC8.tmp"2⤵
- Creates scheduled task(s)
PID:1500
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmp540A.tmpFilesize
1KB
MD5702a884a50d99acf6e6a65d9c4a8f254
SHA12543aa2919ba5e3598281efe848b6b6dbc9f0766
SHA25628b008d4c8ec5930d4283f92d752927479b7d4b5e65b2a436bb1bd26961afb7a
SHA512a4b393e7e3e7af3a7fa5804c564da4ab7d97ffdbf9aef1c09ae9aa7b66c0f58a4d0dc9393292aee42476299b6ef0ad8a47ade45cd832c4a06f7028a28cfe428a
-
C:\Users\Admin\AppData\Local\Temp\tmp5BC8.tmpFilesize
1KB
MD50a24db62cb5b84309c4803346caaa25d
SHA167660778f61bb44168c33ed3fe56ed86cf9583e8
SHA25638d38647af394a04ee6add9f05c43244f04e64a6b96257f4b241a5038efa82df
SHA512d25d9df063f44595d5e0bf890755bd387655131ff369eeedf3d11ffcc6202ca4455bbb33a8a926dd06839cbd1ddec3d06809b3c66a82c6518aa14beaa469a548
-
memory/1500-58-0x0000000000000000-mapping.dmp
-
memory/1520-56-0x0000000000000000-mapping.dmp
-
memory/1720-54-0x0000000075BD1000-0x0000000075BD3000-memory.dmpFilesize
8KB
-
memory/1720-55-0x00000000744F0000-0x0000000074A9B000-memory.dmpFilesize
5.7MB
-
memory/1720-60-0x00000000744F0000-0x0000000074A9B000-memory.dmpFilesize
5.7MB