Analysis
-
max time kernel
151s -
max time network
128s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 07:49
Static task
static1
Behavioral task
behavioral1
Sample
f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe
Resource
win7-20220812-en
windows7-x64
Behavioral task
behavioral2
Sample
f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
General
-
Target
f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe
-
Size
94KB
-
MD5
813fd2f03a4aef64d7b85a7bb89770b0
-
SHA1
e5051bf1c4014cbd691119e9f6447e8d3280fc70
-
SHA256
f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26
-
SHA512
5835252406b807695e257e2fb2fec1475676d6573e0e7d0a6f23a705f7dc7952a6bd6b627c83c4ec6988c14221c9efb63e6677783316f756b85e60bb80ee84ac
-
SSDEEP
1536:NZdvk9dMUQT6IBNzIshyabH/izDSe/BRqNCDep2FU3II08wwEFaaHw7Koj4r1+fq:NTmdMnT6IBG3EkDS4aCc2FaZ0DaaHw7I
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\hufmrpnn\\pbwycswe.exe" svchost.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 1784 hgrteuvktktpwpol.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pbwycswe.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\pbwycswe.exe svchost.exe -
Loads dropped DLL 5 IoCs
pid Process 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\PbwYcswe = "C:\\Users\\Admin\\AppData\\Local\\hufmrpnn\\pbwycswe.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 43 IoCs
pid Process 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe 940 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe Token: SeDebugPrivilege 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe Token: SeSecurityPrivilege 832 svchost.exe Token: SeSecurityPrivilege 940 svchost.exe Token: SeDebugPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeSecurityPrivilege 1784 hgrteuvktktpwpol.exe Token: SeLoadDriverPrivilege 1784 hgrteuvktktpwpol.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe Token: SeBackupPrivilege 940 svchost.exe Token: SeRestorePrivilege 940 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1452 wrote to memory of 832 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 26 PID 1452 wrote to memory of 832 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 26 PID 1452 wrote to memory of 832 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 26 PID 1452 wrote to memory of 832 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 26 PID 1452 wrote to memory of 832 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 26 PID 1452 wrote to memory of 832 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 26 PID 1452 wrote to memory of 832 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 26 PID 1452 wrote to memory of 832 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 26 PID 1452 wrote to memory of 832 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 26 PID 1452 wrote to memory of 832 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 26 PID 1452 wrote to memory of 940 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 27 PID 1452 wrote to memory of 940 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 27 PID 1452 wrote to memory of 940 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 27 PID 1452 wrote to memory of 940 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 27 PID 1452 wrote to memory of 940 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 27 PID 1452 wrote to memory of 940 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 27 PID 1452 wrote to memory of 940 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 27 PID 1452 wrote to memory of 940 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 27 PID 1452 wrote to memory of 940 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 27 PID 1452 wrote to memory of 940 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 27 PID 1452 wrote to memory of 1784 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 28 PID 1452 wrote to memory of 1784 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 28 PID 1452 wrote to memory of 1784 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 28 PID 1452 wrote to memory of 1784 1452 f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe"C:\Users\Admin\AppData\Local\Temp\f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1452 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:832
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:940
-
-
C:\Users\Admin\AppData\Local\Temp\hgrteuvktktpwpol.exe"C:\Users\Admin\AppData\Local\Temp\hgrteuvktktpwpol.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1784
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
94KB
MD5813fd2f03a4aef64d7b85a7bb89770b0
SHA1e5051bf1c4014cbd691119e9f6447e8d3280fc70
SHA256f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26
SHA5125835252406b807695e257e2fb2fec1475676d6573e0e7d0a6f23a705f7dc7952a6bd6b627c83c4ec6988c14221c9efb63e6677783316f756b85e60bb80ee84ac
-
Filesize
94KB
MD5813fd2f03a4aef64d7b85a7bb89770b0
SHA1e5051bf1c4014cbd691119e9f6447e8d3280fc70
SHA256f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26
SHA5125835252406b807695e257e2fb2fec1475676d6573e0e7d0a6f23a705f7dc7952a6bd6b627c83c4ec6988c14221c9efb63e6677783316f756b85e60bb80ee84ac
-
Filesize
94KB
MD5813fd2f03a4aef64d7b85a7bb89770b0
SHA1e5051bf1c4014cbd691119e9f6447e8d3280fc70
SHA256f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26
SHA5125835252406b807695e257e2fb2fec1475676d6573e0e7d0a6f23a705f7dc7952a6bd6b627c83c4ec6988c14221c9efb63e6677783316f756b85e60bb80ee84ac
-
Filesize
94KB
MD5813fd2f03a4aef64d7b85a7bb89770b0
SHA1e5051bf1c4014cbd691119e9f6447e8d3280fc70
SHA256f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26
SHA5125835252406b807695e257e2fb2fec1475676d6573e0e7d0a6f23a705f7dc7952a6bd6b627c83c4ec6988c14221c9efb63e6677783316f756b85e60bb80ee84ac
-
Filesize
94KB
MD5813fd2f03a4aef64d7b85a7bb89770b0
SHA1e5051bf1c4014cbd691119e9f6447e8d3280fc70
SHA256f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26
SHA5125835252406b807695e257e2fb2fec1475676d6573e0e7d0a6f23a705f7dc7952a6bd6b627c83c4ec6988c14221c9efb63e6677783316f756b85e60bb80ee84ac
-
Filesize
94KB
MD5813fd2f03a4aef64d7b85a7bb89770b0
SHA1e5051bf1c4014cbd691119e9f6447e8d3280fc70
SHA256f4db0664b8fe4c78205d8d1ff1dd01bf65a0b4e820d92417796d331f9cf75a26
SHA5125835252406b807695e257e2fb2fec1475676d6573e0e7d0a6f23a705f7dc7952a6bd6b627c83c4ec6988c14221c9efb63e6677783316f756b85e60bb80ee84ac