Analysis
-
max time kernel
133s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19/10/2022, 22:31
Behavioral task
behavioral1
Sample
7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe
Resource
win7-20220901-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe
-
Size
127KB
-
MD5
90e2869b6358f10a54b9f605330bb080
-
SHA1
c9e5645ade83c25078af054e6a40bab3f305c1a1
-
SHA256
7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8
-
SHA512
c2d6db052c53e4421ee388c2d3d29a34287378a874f9efed442006b745956a48d4b9938c00b1228da810b9ed017b88f9365a3276a135c6521911980514550f92
-
SSDEEP
3072:xhaXpckpdyFV9RzPH3UPDVOGE9Bn6AtU7HHwrqdmbOQfJhNK2ktNc:xhaXmmgFV9abEn6AUkiQG2o2
Score
6/10
Malware Config
Signatures
-
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\Y: svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1128 set thread context of 5084 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 84 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4030383161" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateHighDateTime = "30991412" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLLowDateTime = "1251635200" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastTTLHighDateTime = "50" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "373001846" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\VersionManager IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Recovery\AdminActive\{1BBE24CB-5028-11ED-A0EE-DE60447A8195} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastUpdateLowDateTime = "4030383161" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991412" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateLowDateTime = "4039132569" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Internet Explorer\VersionManager\LastCheckForUpdateHighDateTime = "30991412" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2512 mspaint.exe 2512 mspaint.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 776 IEXPLORE.EXE -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 5084 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 776 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 2512 mspaint.exe 2512 mspaint.exe 2512 mspaint.exe 2512 mspaint.exe 776 IEXPLORE.EXE 776 IEXPLORE.EXE 3536 IEXPLORE.EXE 3536 IEXPLORE.EXE 3536 IEXPLORE.EXE 3536 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 26 IoCs
description pid Process procid_target PID 1128 wrote to memory of 1464 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 83 PID 1128 wrote to memory of 1464 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 83 PID 1128 wrote to memory of 1464 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 83 PID 1128 wrote to memory of 1464 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 83 PID 1128 wrote to memory of 1464 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 83 PID 1128 wrote to memory of 1464 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 83 PID 1128 wrote to memory of 5084 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 84 PID 1128 wrote to memory of 5084 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 84 PID 1128 wrote to memory of 5084 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 84 PID 1128 wrote to memory of 5084 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 84 PID 1128 wrote to memory of 5084 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 84 PID 1128 wrote to memory of 5084 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 84 PID 1128 wrote to memory of 5084 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 84 PID 1128 wrote to memory of 5084 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 84 PID 1128 wrote to memory of 5084 1128 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 84 PID 1464 wrote to memory of 2512 1464 svchost.exe 85 PID 1464 wrote to memory of 2512 1464 svchost.exe 85 PID 1464 wrote to memory of 2512 1464 svchost.exe 85 PID 5084 wrote to memory of 216 5084 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 89 PID 5084 wrote to memory of 216 5084 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 89 PID 5084 wrote to memory of 216 5084 7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe 89 PID 216 wrote to memory of 776 216 iexplore.exe 90 PID 216 wrote to memory of 776 216 iexplore.exe 90 PID 776 wrote to memory of 3536 776 IEXPLORE.EXE 91 PID 776 wrote to memory of 3536 776 IEXPLORE.EXE 91 PID 776 wrote to memory of 3536 776 IEXPLORE.EXE 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe"C:\Users\Admin\AppData\Local\Temp\7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1128 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Enumerates connected drives
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe"3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2512
-
-
-
C:\Users\Admin\AppData\Local\Temp\7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe"C:\Users\Admin\AppData\Local\Temp\7733b3bc9b01649aa7ff709b2787b6919a05c0123fceb13e05acc0e2119461c8.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5084 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:216 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:776 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:776 CREDAT:17410 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx
PID:3536
-
-
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalSystemNetworkRestricted -p -s DeviceAssociationService1⤵PID:3660
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize471B
MD5d3ff0edeee7d1ea5754d8a290ae01189
SHA1253ee24a4776d30bac0aedd7ea213adea6acb6f9
SHA256e2e542a3681c428c021d38e608dffa43da666f6f3c53f623c21dc184639b222b
SHA512ab14449059ae31856026e8d8cb0ec0b4158da0fd19f2a73940a159574a9084ce6a09ac05fb80ef3ab11cd9b1395dce021872215baced48f9e8a0bf7311000db7
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\7423F88C7F265F0DEFC08EA88C3BDE45_AA1E8580D4EBC816148CE81268683776
Filesize434B
MD5967bb052bf23f213d5c7dbed4867c5e0
SHA18045cb8b84d8fc58307b60baa6c01592aa3ab02e
SHA2565cd67939b428e375a80930364255b45fc8a64080ede01140a744d241e8bf5951
SHA512d67c93b69a6c8bb17d7f0d5a2cdfb1a6c5e1aecad82935d25760c1eb832d89d5cd94d4942849bff664449a387b431e7f983b5ca10c5c419a35d7e09839b683b0