Analysis
-
max time kernel
150s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 08:57
Static task
static1
Behavioral task
behavioral1
Sample
427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe
-
Size
288KB
-
MD5
5659080194fdab1470d81c21ea0271af
-
SHA1
f622d6349954221242a2182eaf8ffe351dd33a59
-
SHA256
427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e
-
SHA512
1234e1f2ff89a9b3e51249d621111ede69da065e770ba91e9f96be1e67de2cfcc983573d9c1383cc4084420dbd8c21cc2094a4946c607ce6502faca2bb496f62
-
SSDEEP
6144:7iELZDQ6Ie5at43+8/iNoC8r6axpu4+pVRo8X16+e:7iELZDKe5U4XiWvuxVRo8l6+e
Score
10/10
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\Content Type = "application/x-msdownload" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\open\command ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\DefaultIcon ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\DefaultIcon\ = "%1" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\runas ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\runas\command ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\start ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\ = "Application" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\open ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ddd.exe\" -a \"%1\" %*" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\start\command ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" ddd.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1908 ddd.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
pid Process 1908 ddd.exe -
Loads dropped DLL 2 IoCs
pid Process 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\WINDOWS\\system32\\ctfmon.exe" ddd.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe -
Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\open ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\start\command ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\DefaultIcon ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\DefaultIcon\ = "%1" ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\runas ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\ = "exefile" ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\ = "Application" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\runas\command ddd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\Content Type = "application/x-msdownload" ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\DefaultIcon\ = "%1" ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ddd.exe\" -a \"%1\" %*" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\runas\command ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\runas ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\start\command\IsolatedCommand = "\"%1\" %*" ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\open ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\start ddd.exe Set value (data) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\open\command ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\Content Type = "application/x-msdownload" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\start ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\DefaultIcon ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\start\command ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\.exe\shell\start\command\ = "\"%1\" %*" ddd.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\open\command ddd.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\ddd.exe\" -a \"%1\" %*" ddd.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 1908 ddd.exe 1908 ddd.exe 1908 ddd.exe 1908 ddd.exe 1908 ddd.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: 33 664 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 664 AUDIODG.EXE Token: 33 664 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 664 AUDIODG.EXE Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe Token: SeShutdownPrivilege 1984 explorer.exe -
Suspicious use of FindShellTrayWindow 34 IoCs
pid Process 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1908 ddd.exe 1984 explorer.exe 1984 explorer.exe 1908 ddd.exe 1984 explorer.exe 1984 explorer.exe -
Suspicious use of SendNotifyMessage 21 IoCs
pid Process 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1984 explorer.exe 1908 ddd.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1708 wrote to memory of 1908 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 27 PID 1708 wrote to memory of 1908 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 27 PID 1708 wrote to memory of 1908 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 27 PID 1708 wrote to memory of 1908 1708 427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe"C:\Users\Admin\AppData\Local\Temp\427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Users\Admin\AppData\Local\ddd.exe"C:\Users\Admin\AppData\Local\ddd.exe" -gav C:\Users\Admin\AppData\Local\Temp\427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e.exe2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1908
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1984
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5901⤵
- Suspicious use of AdjustPrivilegeToken
PID:664
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
288KB
MD55659080194fdab1470d81c21ea0271af
SHA1f622d6349954221242a2182eaf8ffe351dd33a59
SHA256427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e
SHA5121234e1f2ff89a9b3e51249d621111ede69da065e770ba91e9f96be1e67de2cfcc983573d9c1383cc4084420dbd8c21cc2094a4946c607ce6502faca2bb496f62
-
Filesize
288KB
MD55659080194fdab1470d81c21ea0271af
SHA1f622d6349954221242a2182eaf8ffe351dd33a59
SHA256427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e
SHA5121234e1f2ff89a9b3e51249d621111ede69da065e770ba91e9f96be1e67de2cfcc983573d9c1383cc4084420dbd8c21cc2094a4946c607ce6502faca2bb496f62
-
Filesize
288KB
MD55659080194fdab1470d81c21ea0271af
SHA1f622d6349954221242a2182eaf8ffe351dd33a59
SHA256427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e
SHA5121234e1f2ff89a9b3e51249d621111ede69da065e770ba91e9f96be1e67de2cfcc983573d9c1383cc4084420dbd8c21cc2094a4946c607ce6502faca2bb496f62
-
Filesize
288KB
MD55659080194fdab1470d81c21ea0271af
SHA1f622d6349954221242a2182eaf8ffe351dd33a59
SHA256427b82fd6c62e14de124c0e44907609667ed70906685f5c5e371a2440b8d017e
SHA5121234e1f2ff89a9b3e51249d621111ede69da065e770ba91e9f96be1e67de2cfcc983573d9c1383cc4084420dbd8c21cc2094a4946c607ce6502faca2bb496f62