7e48a2f2231593640d5659851dad095edf15e19c24dbe1e29297ddc52fcf8f2b

Analysis

max time kernel
152s
max time network
149s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
20/10/2022, 03:18

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7e48a2f2231593640d5659851dad095edf15e19c24dbe1e29297ddc52fcf8f2b.exe
Size

212KB
MD5

52aa68a076b089ea3570b00f1891e4a4
SHA1

430e28c1452084e41954d3a7c3d2b3b9642df4bb
SHA256

7e48a2f2231593640d5659851dad095edf15e19c24dbe1e29297ddc52fcf8f2b
SHA512

676773c2b4a6228cfb1e056c969ef7a7f8ef7b214bc777912ddc85138b847d55c808cbcb7811ab72547f58dd141f6644e7f6b34282dbc0b592e1caaa151a36bb
SSDEEP

3072:ZQExuz37QQK2PFuCNZ1z4FtP7qM98mORblMMIVBri4hDjKNhLf9TOaB4:VxuzthbZAOM98tp4vrLpGN1f9Oa2

Score

10^/10

evasion persistence trojan

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\ecnjerrw\\micvorbn.exe"	svchost.exe

UAC bypass 3 TTPs 1 IoCs

evasion trojan

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0"	svchost.exe

Executes dropped EXE 2 IoCs

pid	Process
1160	SLw9R23
596	enaqqtatiymiedoe.exe

Checks BIOS information in registry 2 TTPs 1 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	svchost.exe

Drops startup file 2 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\micvorbn.exe	svchost.exe
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\micvorbn.exe	svchost.exe

Loads dropped DLL 6 IoCs

pid	Process
748	7e48a2f2231593640d5659851dad095edf15e19c24dbe1e29297ddc52fcf8f2b.exe
748	7e48a2f2231593640d5659851dad095edf15e19c24dbe1e29297ddc52fcf8f2b.exe
1160	SLw9R23
1160	SLw9R23
1160	SLw9R23
1160	SLw9R23

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\MicVorbn = "C:\\Users\\Admin\\AppData\\Local\\ecnjerrw\\micvorbn.exe"	svchost.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 43 IoCs

pid	Process
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe
1760	svchost.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeSecurityPrivilege	1160	SLw9R23
Token: SeDebugPrivilege	1160	SLw9R23
Token: SeSecurityPrivilege	1780	svchost.exe
Token: SeSecurityPrivilege	1760	svchost.exe
Token: SeDebugPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe
Token: SeBackupPrivilege	1760	svchost.exe
Token: SeRestorePrivilege	1760	svchost.exe

Suspicious use of WriteProcessMemory 28 IoCs

description	pid	Process	procid_target
PID 748 wrote to memory of 1160	748	7e48a2f2231593640d5659851dad095edf15e19c24dbe1e29297ddc52fcf8f2b.exe	28
PID 748 wrote to memory of 1160	748	7e48a2f2231593640d5659851dad095edf15e19c24dbe1e29297ddc52fcf8f2b.exe	28
PID 748 wrote to memory of 1160	748	7e48a2f2231593640d5659851dad095edf15e19c24dbe1e29297ddc52fcf8f2b.exe	28
PID 748 wrote to memory of 1160	748	7e48a2f2231593640d5659851dad095edf15e19c24dbe1e29297ddc52fcf8f2b.exe	28
PID 1160 wrote to memory of 1780	1160	SLw9R23	29
PID 1160 wrote to memory of 1780	1160	SLw9R23	29
PID 1160 wrote to memory of 1780	1160	SLw9R23	29
PID 1160 wrote to memory of 1780	1160	SLw9R23	29
PID 1160 wrote to memory of 1780	1160	SLw9R23	29
PID 1160 wrote to memory of 1780	1160	SLw9R23	29
PID 1160 wrote to memory of 1780	1160	SLw9R23	29
PID 1160 wrote to memory of 1780	1160	SLw9R23	29
PID 1160 wrote to memory of 1780	1160	SLw9R23	29
PID 1160 wrote to memory of 1780	1160	SLw9R23	29
PID 1160 wrote to memory of 1760	1160	SLw9R23	30
PID 1160 wrote to memory of 1760	1160	SLw9R23	30
PID 1160 wrote to memory of 1760	1160	SLw9R23	30
PID 1160 wrote to memory of 1760	1160	SLw9R23	30
PID 1160 wrote to memory of 1760	1160	SLw9R23	30
PID 1160 wrote to memory of 1760	1160	SLw9R23	30
PID 1160 wrote to memory of 1760	1160	SLw9R23	30
PID 1160 wrote to memory of 1760	1160	SLw9R23	30
PID 1160 wrote to memory of 1760	1160	SLw9R23	30
PID 1160 wrote to memory of 1760	1160	SLw9R23	30
PID 1160 wrote to memory of 596	1160	SLw9R23	31
PID 1160 wrote to memory of 596	1160	SLw9R23	31
PID 1160 wrote to memory of 596	1160	SLw9R23	31
PID 1160 wrote to memory of 596	1160	SLw9R23	31

C:\Users\Admin\AppData\Local\Temp\7e48a2f2231593640d5659851dad095edf15e19c24dbe1e29297ddc52fcf8f2b.exe
"C:\Users\Admin\AppData\Local\Temp\7e48a2f2231593640d5659851dad095edf15e19c24dbe1e29297ddc52fcf8f2b.exe"
1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:748
- C:\Users\Admin\AppData\Local\Temp\SLw9R23
  "SLw9R23"
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1160
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    PID:1780
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Modifies WinLogon for persistence
    - UAC bypass
    - Checks BIOS information in registry
    - Drops startup file
    - Adds Run key to start application
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    PID:1760
- - C:\Users\Admin\AppData\Local\Temp\enaqqtatiymiedoe.exe
    "C:\Users\Admin\AppData\Local\Temp\enaqqtatiymiedoe.exe"
    3⤵
    - Executes dropped EXE
    PID:596

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Winlogon Helper DLL

T1004

Privilege Escalation

Bypass User Account Control

T1088

Defense Evasion

Bypass User Account Control

T1088

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SLw9R23

Filesize
94KB

MD5
9b0f876cef335a2489822b49588ed462

SHA1
be7036761b0a1fbcb7d5aeb7f10e39368d871029

SHA256
3acfc174c67d0121ce5335888a7b559d44c94849e7f429c0509c487b5b533669

SHA512
bbf042c2190c2bab6227b84258fcf0ce8435960c2c47a9430a2fe27eccea84f9dc9e0c5487052f9b90f5459a323be2546df98e940e22c96dcc445ed4829b215b

Download Submit
C:\Users\Admin\AppData\Local\Temp\SLw9R23

Filesize
94KB

MD5
9b0f876cef335a2489822b49588ed462

SHA1
be7036761b0a1fbcb7d5aeb7f10e39368d871029

SHA256
3acfc174c67d0121ce5335888a7b559d44c94849e7f429c0509c487b5b533669

SHA512
bbf042c2190c2bab6227b84258fcf0ce8435960c2c47a9430a2fe27eccea84f9dc9e0c5487052f9b90f5459a323be2546df98e940e22c96dcc445ed4829b215b

Download Submit
C:\Users\Admin\AppData\Local\Temp\enaqqtatiymiedoe.exe

Filesize
94KB

MD5
9b0f876cef335a2489822b49588ed462

SHA1
be7036761b0a1fbcb7d5aeb7f10e39368d871029

SHA256
3acfc174c67d0121ce5335888a7b559d44c94849e7f429c0509c487b5b533669

SHA512
bbf042c2190c2bab6227b84258fcf0ce8435960c2c47a9430a2fe27eccea84f9dc9e0c5487052f9b90f5459a323be2546df98e940e22c96dcc445ed4829b215b

Download Submit
C:\Users\Admin\AppData\Local\Temp\enaqqtatiymiedoe.exe

Filesize
94KB

MD5
9b0f876cef335a2489822b49588ed462

SHA1
be7036761b0a1fbcb7d5aeb7f10e39368d871029

SHA256
3acfc174c67d0121ce5335888a7b559d44c94849e7f429c0509c487b5b533669

SHA512
bbf042c2190c2bab6227b84258fcf0ce8435960c2c47a9430a2fe27eccea84f9dc9e0c5487052f9b90f5459a323be2546df98e940e22c96dcc445ed4829b215b

Download Submit
\Users\Admin\AppData\Local\Temp\SLw9R23

Filesize
94KB

MD5
9b0f876cef335a2489822b49588ed462

SHA1
be7036761b0a1fbcb7d5aeb7f10e39368d871029

SHA256
3acfc174c67d0121ce5335888a7b559d44c94849e7f429c0509c487b5b533669

SHA512
bbf042c2190c2bab6227b84258fcf0ce8435960c2c47a9430a2fe27eccea84f9dc9e0c5487052f9b90f5459a323be2546df98e940e22c96dcc445ed4829b215b

Download Submit
\Users\Admin\AppData\Local\Temp\SLw9R23

Filesize
94KB

MD5
9b0f876cef335a2489822b49588ed462

SHA1
be7036761b0a1fbcb7d5aeb7f10e39368d871029

SHA256
3acfc174c67d0121ce5335888a7b559d44c94849e7f429c0509c487b5b533669

SHA512
bbf042c2190c2bab6227b84258fcf0ce8435960c2c47a9430a2fe27eccea84f9dc9e0c5487052f9b90f5459a323be2546df98e940e22c96dcc445ed4829b215b

Download Submit
\Users\Admin\AppData\Local\Temp\enaqqtatiymiedoe.exe

Filesize
94KB

MD5
9b0f876cef335a2489822b49588ed462

SHA1
be7036761b0a1fbcb7d5aeb7f10e39368d871029

SHA256
3acfc174c67d0121ce5335888a7b559d44c94849e7f429c0509c487b5b533669

SHA512
bbf042c2190c2bab6227b84258fcf0ce8435960c2c47a9430a2fe27eccea84f9dc9e0c5487052f9b90f5459a323be2546df98e940e22c96dcc445ed4829b215b

Download Submit
\Users\Admin\AppData\Local\Temp\enaqqtatiymiedoe.exe

Filesize
94KB

MD5
9b0f876cef335a2489822b49588ed462

SHA1
be7036761b0a1fbcb7d5aeb7f10e39368d871029

SHA256
3acfc174c67d0121ce5335888a7b559d44c94849e7f429c0509c487b5b533669

SHA512
bbf042c2190c2bab6227b84258fcf0ce8435960c2c47a9430a2fe27eccea84f9dc9e0c5487052f9b90f5459a323be2546df98e940e22c96dcc445ed4829b215b

Download Submit
\Users\Admin\AppData\Local\Temp\enaqqtatiymiedoe.exe

Filesize
94KB

MD5
9b0f876cef335a2489822b49588ed462

SHA1
be7036761b0a1fbcb7d5aeb7f10e39368d871029

SHA256
3acfc174c67d0121ce5335888a7b559d44c94849e7f429c0509c487b5b533669

SHA512
bbf042c2190c2bab6227b84258fcf0ce8435960c2c47a9430a2fe27eccea84f9dc9e0c5487052f9b90f5459a323be2546df98e940e22c96dcc445ed4829b215b

Download Submit
\Users\Admin\AppData\Local\Temp\enaqqtatiymiedoe.exe

Filesize
94KB

MD5
9b0f876cef335a2489822b49588ed462

SHA1
be7036761b0a1fbcb7d5aeb7f10e39368d871029

SHA256
3acfc174c67d0121ce5335888a7b559d44c94849e7f429c0509c487b5b533669

SHA512
bbf042c2190c2bab6227b84258fcf0ce8435960c2c47a9430a2fe27eccea84f9dc9e0c5487052f9b90f5459a323be2546df98e940e22c96dcc445ed4829b215b

Download Submit
memory/596-91-0x0000000000400000-0x0000000000439BE4-memory.dmp

Filesize
230KB

Download
memory/596-89-0x0000000000400000-0x0000000000439BE4-memory.dmp

Filesize
230KB

Download
memory/596-92-0x0000000000400000-0x0000000000439BE4-memory.dmp

Filesize
230KB

Download
memory/748-59-0x0000000000400000-0x0000000000435000-memory.dmp

Filesize
212KB

Download
memory/1160-85-0x0000000002AB0000-0x0000000002AEA000-memory.dmp

Filesize
232KB

Download
memory/1160-79-0x0000000000400000-0x0000000000439BE4-memory.dmp

Filesize
230KB

Download
memory/1160-84-0x0000000002AB0000-0x0000000002AEA000-memory.dmp

Filesize
232KB

Download
memory/1160-60-0x0000000075B11000-0x0000000075B13000-memory.dmp

Filesize
8KB

Download
memory/1760-75-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/1760-71-0x0000000020010000-0x000000002002C000-memory.dmp

Filesize
112KB

Download
memory/1780-65-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download
memory/1780-62-0x0000000020010000-0x000000002001C000-memory.dmp

Filesize
48KB

Download