Analysis
-
max time kernel
111s -
max time network
115s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
20/10/2022, 10:34
Behavioral task
behavioral1
Sample
b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe
-
Size
76KB
-
MD5
73ea051ff30775f2414ed0cbc8f705e0
-
SHA1
ffb035f8c2c01af455c169a4792bc82670567308
-
SHA256
b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11
-
SHA512
45bb8c690c339d5b4d7286e38fc3719d6f44796c380342771f42c3fbe20824921b2a2aed205ade966e6379c46822de0bdd5113bb992bfd95735050fb889dd9e0
-
SSDEEP
1536:bpvF99rQswQ25+9Pn9tbfoBQy6XKEYo8+uHOdRdSBuGJOT:9vN8VQ/nn06hvSHmdFGJ6
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\TXP1atform.exe b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe File created C:\Windows\SysWOW64\drivers\TXP1atform.exe b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe -
Executes dropped EXE 1 IoCs
pid Process 3188 TXP1atform.exe -
Sets file execution options in registry 2 TTPs 45 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GRAPH.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRINTISOLATIONHOST.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SELFCERT.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SETLANG.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SPLWOW64.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SVCHOST.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WINWORD.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSFEEDSSYNC.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSQRY32.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NGEN.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\NGENTASK.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ORGCHART.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RUNTIMEBROKER.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXTEXPORT.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\GOOGLEUPDATE.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOADFSB.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOSYNC.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RDRCEF.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\RDRSERVICESUPDATER.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SDXHELPER.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SPOOLSV.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\CLVIEW.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXCELCNV.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IE4UINIT.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IELOWUTIL.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\WORDCONV.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEUNATT.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MRT.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSCORSVW.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\SYSTEMSETTINGS.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\ACRORD32INFO.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\EXCEL.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOXMLED.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRINTDIALOG.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEINSTAL.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MICROSOFTEDGEUPDATE.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSHTA.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\PRESENTATIONHOST.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\IEXPLORE.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOASB.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOHTMED.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\MSOSREC.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\MICROSOFT\WINDOWS NT\CURRENTVERSION\IMAGE FILE EXECUTION OPTIONS\POWERPNT.EXE b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe -
resource yara_rule behavioral2/files/0x0003000000022dc9-134.dat upx behavioral2/files/0x0003000000022dc9-133.dat upx behavioral2/memory/3188-135-0x0000000000400000-0x000000000044A000-memory.dmp upx behavioral2/memory/1388-136-0x0000000000400000-0x000000000044A000-memory.dmp upx -
Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe 3188 TXP1atform.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1388 wrote to memory of 3188 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 82 PID 1388 wrote to memory of 3188 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 82 PID 1388 wrote to memory of 3188 1388 b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe"C:\Users\Admin\AppData\Local\Temp\b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11.exe"1⤵
- Drops file in Drivers directory
- Sets file execution options in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\drivers\TXP1atform.exeC:\Windows\system32\drivers\TXP1atform.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:3188
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
76KB
MD573ea051ff30775f2414ed0cbc8f705e0
SHA1ffb035f8c2c01af455c169a4792bc82670567308
SHA256b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11
SHA51245bb8c690c339d5b4d7286e38fc3719d6f44796c380342771f42c3fbe20824921b2a2aed205ade966e6379c46822de0bdd5113bb992bfd95735050fb889dd9e0
-
Filesize
76KB
MD573ea051ff30775f2414ed0cbc8f705e0
SHA1ffb035f8c2c01af455c169a4792bc82670567308
SHA256b66db8b34b4081a3a7790ca386c91be638cfe7a7a5d86c2138eb0e189c973e11
SHA51245bb8c690c339d5b4d7286e38fc3719d6f44796c380342771f42c3fbe20824921b2a2aed205ade966e6379c46822de0bdd5113bb992bfd95735050fb889dd9e0