93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0

Analysis

max time kernel
42s
max time network
49s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
11/10/2022, 15:54

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe
Size

52KB
MD5

7c7112f50b926aa343a031f874594560
SHA1

10f2a55df8f18ae59c1b211f7794d7fbd0fb8f51
SHA256

93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0
SHA512

121281cbcb30e32d5c91ac32ee00737316a0b618964474fd5bc54e7232cdb90dac7d0bae6af6d21981c4b2bdb798f0edb8eeb00f406e943e647b7b0d17b2e87a
SSDEEP

768:hnpJJhVdidCdMiXb+FQOP2yiZVmyGt6YWfkg6m8wNVgxxzMza8:lVkUDqhuyiPYWfkgbrgv8

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\msosmsfpfis64.sys	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe

Modifies AppInit DLL entries 2 TTPs
persistence

Registry Run Keys / Startup Folder
T1060

Modify Registry
T1112

Deletes itself 1 IoCs

pid	Process
1560	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\msosping00.dll	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe
File opened for modification	C:\Windows\SysWOW64\msosping00.dll	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe
File opened for modification	C:\Windows\SysWOW64\msosping.dat	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\win.ini	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe
1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe
1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
460	services.exe
460	services.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 1016 wrote to memory of 260	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	7
PID 1016 wrote to memory of 332	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	6
PID 1016 wrote to memory of 368	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	5
PID 1016 wrote to memory of 376	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	4
PID 1016 wrote to memory of 416	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	3
PID 1016 wrote to memory of 460	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	2
PID 1016 wrote to memory of 476	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	1
PID 1016 wrote to memory of 484	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	8
PID 1016 wrote to memory of 584	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	27
PID 1016 wrote to memory of 664	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	26
PID 1016 wrote to memory of 748	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	25
PID 1016 wrote to memory of 796	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	23
PID 1016 wrote to memory of 824	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	22
PID 1016 wrote to memory of 872	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	21
PID 1016 wrote to memory of 284	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	20
PID 1016 wrote to memory of 112	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	19
PID 1016 wrote to memory of 600	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	18
PID 1016 wrote to memory of 1276	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	9
PID 1016 wrote to memory of 1356	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	17
PID 1016 wrote to memory of 1404	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	16
PID 1016 wrote to memory of 528	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	14
PID 1016 wrote to memory of 1180	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	13
PID 1016 wrote to memory of 1976	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	10
PID 1016 wrote to memory of 1940	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	12
PID 1016 wrote to memory of 1560	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	28
PID 1016 wrote to memory of 1560	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	28
PID 1016 wrote to memory of 1560	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	28
PID 1016 wrote to memory of 1560	1016	93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe	28

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:476

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
- Suspicious behavior: LoadsDriver
PID:460
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1276
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:1180
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:528
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:600
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:112
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:284
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  PID:872
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:824
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:796
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:748
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:664
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:584

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
PID:416

C:\Windows\system32\wininit.exe
wininit.exe
1⤵
PID:376
- C:\Windows\system32\lsm.exe
  C:\Windows\system32\lsm.exe
  2⤵
  PID:484

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:368

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
PID:332

C:\Windows\System32\smss.exe
\SystemRoot\System32\smss.exe
1⤵
PID:260

\\?\C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:1976

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe
1⤵
PID:1940

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1404
- C:\Users\Admin\AppData\Local\Temp\93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe
  "C:\Users\Admin\AppData\Local\Temp\93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe"
  2⤵
  - Drops file in Drivers directory
  - Loads dropped DLL
  - Drops file in System32 directory
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1016
- - C:\Windows\SysWOW64\cmd.exe
    C:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\93014b626961f84a2d2bd6e58909172fb39c8bd4ea5263a166d6eb2350725bf0.exe"
    3⤵
    - Deletes itself
    PID:1560

C:\Windows\system32\Dwm.exe
"C:\Windows\system32\Dwm.exe"
1⤵
PID:1356

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\tmpEDE9.tmp

Filesize
11KB

MD5
219e6c2fd63e728e0073c8a1d17f1218

SHA1
76863e6fb0e88c9bb900499062f594261d2a693d

SHA256
1f34a65693a665159e44cffca00b82b15680ab77773a444451eca70e2d018350

SHA512
93ec55279b74c0ca62d2dfaa51656eb29ea0b1d8ea3b845cf7bce8180918b124bac07924d80947522817b150e341b55044ee3bb1302394cf5dbe92dc3f825731

Download Submit
memory/1016-56-0x0000000010000000-0x0000000010027000-memory.dmp

Filesize
156KB

Download