Analysis
-
max time kernel
152s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 13:07
Static task
static1
Behavioral task
behavioral1
Sample
e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe.exe
-
Size
750KB
-
MD5
968d4694f0eaf31cde27c88eccbfc2fc
-
SHA1
c35b1865e94d24300776d10de539dd3e95c21dc9
-
SHA256
e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe
-
SHA512
152eb5b1681c31fd6ced0ce4e6f17c10138f5e158f1321766ac92aca65d9771f46cc59ff4b4548e8737191fd81ee54a5d2a1fe18f25a113c5db0c31f14a06da5
-
SSDEEP
12288:DdhwZNlHnVNP4nakObDzBm/8G17Y+gdDhFmG3PT01VKzODttahi8zTjFaRJqtsAI:Dm1NP4nakObDzBm/8G1U+M9FmG3PT0wq
Score
8/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1880 kelly.exe -
Loads dropped DLL 2 IoCs
pid Process 1976 e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe.exe 1976 e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\SetIEInstalledDate.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\wextract.exe kelly.exe File opened for modification C:\Windows\SysWOW64\reg.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\sbunattend.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\cttune.exe kelly.exe File created C:\Windows\SysWOW64\dpnsvr.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\help.exe kelly.exe File created C:\Windows\SysWOW64\ocsetup.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\bitsadmin.exe kelly.exe File opened for modification C:\Windows\SysWOW64\waitfor.exe kelly.exe File created C:\Windows\SysWOW64\msscript.ocx$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\migwiz\PostMig.exe kelly.exe File opened for modification C:\Windows\SysWOW64\WSManHTTPConfig.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\PING.EXE kelly.exe File opened for modification C:\Windows\SysWOW64\tree.com$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\RegisterIEPKEYs.exe kelly.exe File opened for modification C:\Windows\SysWOW64\autofmt.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\TapiUnattend.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\hdwwiz.cpl$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\logagent.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\winrs.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\dcomcnfg.exe kelly.exe File created C:\Windows\SysWOW64\ndadmin.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\notepad.exe kelly.exe File opened for modification C:\Windows\SysWOW64\wimserv.exe kelly.exe File opened for modification C:\Windows\SysWOW64\MSCOMCTL.OCX kelly.exe File opened for modification C:\Windows\SysWOW64\find.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\DevicePairingWizard.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\TRACERT.EXE$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\dvdplay.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\Mystify.scr$$$ kelly.exe File created C:\Windows\SysWOW64\findstr.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\fltMC.exe kelly.exe File created C:\Windows\SysWOW64\grpconv.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\msfeedssync.exe kelly.exe File opened for modification C:\Windows\SysWOW64\rasphone.exe kelly.exe File created C:\Windows\SysWOW64\more.com$$$ kelly.exe File created C:\Windows\SysWOW64\LocationNotifications.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\runas.exe kelly.exe File opened for modification C:\Windows\SysWOW64\SearchIndexer.exe kelly.exe File opened for modification C:\Windows\SysWOW64\TSTheme.exe kelly.exe File created C:\Windows\SysWOW64\WerFaultSecure.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\Bubbles.scr$$$ kelly.exe File opened for modification C:\Windows\System32\DriverStore\FileRepository\wvmic.inf_amd64_neutral_b94eb92e8150fa35\vmicsvc.exe kelly.exe File opened for modification C:\Windows\SysWOW64\certreq.exe$$$ kelly.exe File created C:\Windows\SysWOW64\compact.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\EhStorAuthn.exe kelly.exe File created C:\Windows\SysWOW64\eventcreate.exe$$$ kelly.exe File created C:\Windows\SysWOW64\notepad.exe$$$ kelly.exe File created C:\Windows\SysWOW64\odbcad32.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\SystemPropertiesRemote.exe kelly.exe File opened for modification C:\Windows\SysWOW64\eudcedit.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\netsh.exe$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\PkgMgr.exe kelly.exe File opened for modification C:\Windows\SysWOW64\runonce.exe kelly.exe File created C:\Windows\SysWOW64\Firewall.cpl$$$ kelly.exe File created C:\Windows\SysWOW64\gpresult.exe$$$ kelly.exe File created C:\Windows\SysWOW64\secinit.exe$$$ kelly.exe File created C:\Windows\SysWOW64\sysmon.ocx$$$ kelly.exe File opened for modification C:\Windows\SysWOW64\bootcfg.exe kelly.exe File opened for modification C:\Windows\SysWOW64\winver.exe kelly.exe File created C:\Windows\SysWOW64\autofmt.exe$$$ kelly.exe File created C:\Windows\SysWOW64\driverquery.exe$$$ kelly.exe File created C:\Windows\SysWOW64\SearchIndexer.exe$$$ kelly.exe -
Drops file in Windows directory 64 IoCs
description ioc Process File opened for modification C:\Windows\notepad.exe kelly.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\Narrator\0bae62c3fc6c327ed24989263988173d\Narrator.ni.exe kelly.exe File opened for modification C:\Windows\ehome\ehprivjob.exe kelly.exe File opened for modification C:\Windows\Fonts\GlobalSerif.CompositeFont kelly.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\pptico.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ServiceModelReg.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe kelly.exe File opened for modification C:\Windows\assembly\GAC_64\mcupdate\6.1.0.0__31bf3856ad364e35\mcupdate.exe kelly.exe File opened for modification C:\Windows\ehome\ehrec.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\ComSvcConfig.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_wp.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\GlobalSerif.CompositeFont kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\EdmGen.exe kelly.exe File opened for modification C:\Windows\ehome\ehsched.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\CasPol.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\GlobalUserInterface.CompositeFont kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_regiis.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\CONFIG\machine.config.comments kelly.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\WsatConfig\9683999d889dc0b8782c782e2fc1aee5\WsatConfig.ni.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\WsatConfig.exe kelly.exe File opened for modification C:\Windows\HelpPane.exe kelly.exe File opened for modification C:\Windows\ehome\mcspad.exe kelly.exe File opened for modification C:\Windows\ehome\mcupdate.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v3.5\csc.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\Fonts\GlobalMonospace.CompositeFont kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_compiler.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe kelly.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\misc.exe kelly.exe File opened for modification C:\Windows\assembly\GAC_MSIL\dfsvc\2.0.0.0__b03f5f7f11d50a3a\dfsvc.exe kelly.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\Microsoft.W71daf281#\df459c0a2762c33e0699703f186b1751\Microsoft.Workflow.Compiler.ni.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe kelly.exe File opened for modification C:\Windows\Speech\Common\sapisvr.exe kelly.exe File opened for modification C:\Windows\ehome\ehtray.exe kelly.exe File opened for modification C:\Windows\ehome\ehvid.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess32.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v3.5\WFServicesReg.exe kelly.exe File created C:\Windows\winhlp32.exe$$$ kelly.exe File opened for modification C:\Windows\assembly\GAC_32\ehexthost32\6.1.0.0__31bf3856ad364e35\ehexthost32.exe kelly.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\ehExtHost32\c899de3549784161aa66610d5735e4f0\ehExtHost32.ni.exe kelly.exe File opened for modification C:\Windows\ehome\mcGlidHost.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\AddInProcess.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\Microsoft.Workflow.Compiler.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\csc.exe kelly.exe File opened for modification C:\Windows\bfsvc.exe kelly.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_64\PresentationFontCac#\0246845f487e5f33d3564eff578665a3\PresentationFontCache.ni.exe kelly.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_64\dfsvc\bb4a1994db088e84b9d383271b082250\dfsvc.ni.exe kelly.exe File opened for modification C:\Windows\Boot\PCAT\memtest.exe kelly.exe File opened for modification C:\Windows\Installer\{90140000-0011-0000-0000-0000000FF1CE}\cagicon.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\csc.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\DataSvcUtil.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe kelly.exe File opened for modification C:\Windows\assembly\NativeImages_v2.0.50727_32\dfsvc\2c3e7fda8de40e45e7f5e004094dc7c9\dfsvc.ni.exe kelly.exe File opened for modification C:\Windows\assembly\NativeImages_v4.0.30319_32\MSBuild\b93c627ec2e15c2675bcc81edafb10be\MSBuild.ni.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_wp.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\MSBuild.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\aspnet_state.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v2.0.50727\IEExec.exe kelly.exe File opened for modification C:\Windows\Installer\{90140000-006E-0409-0000-0000000FF1CE}\misc.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework\v4.0.30319\ngen.exe kelly.exe File opened for modification C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe kelly.exe File opened for modification C:\Windows\assembly\GAC_MSIL\Narrator\6.1.0.0__31bf3856ad364e35\Narrator.exe kelly.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1880 kelly.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1880 kelly.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1976 wrote to memory of 1880 1976 e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe.exe 26 PID 1976 wrote to memory of 1880 1976 e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe.exe 26 PID 1976 wrote to memory of 1880 1976 e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe.exe 26 PID 1976 wrote to memory of 1880 1976 e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe.exe 26
Processes
-
C:\Users\Admin\AppData\Local\Temp\e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe.exe"C:\Users\Admin\AppData\Local\Temp\e221f554e120c0c5272a93eadf51421028e839386f84eed41850e525990bdfbe.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1976 -
C:\Windows\SysWOW64\kelly.exe"kelly.exe"2⤵
- Executes dropped EXE
- Drops file in System32 directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1880
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
774KB
MD5f16c7110795ea0034f96606b8764885b
SHA11f3762e914114eec140fab47044c57858b65b0bc
SHA2565d9c4e8e3faa3b29bae31e970f1e08c004e2dab453dfdea2e16e7bc2c682eb75
SHA512aabc17566656ad7106265cd6a3a6956669e91272b457c5801d46be9ae1edd4824883d49a8a8d0dda7dfb0cb3805273e6632a585d7260f38c2675be5d2dc94d25
-
Filesize
774KB
MD5f16c7110795ea0034f96606b8764885b
SHA11f3762e914114eec140fab47044c57858b65b0bc
SHA2565d9c4e8e3faa3b29bae31e970f1e08c004e2dab453dfdea2e16e7bc2c682eb75
SHA512aabc17566656ad7106265cd6a3a6956669e91272b457c5801d46be9ae1edd4824883d49a8a8d0dda7dfb0cb3805273e6632a585d7260f38c2675be5d2dc94d25
-
Filesize
774KB
MD5f16c7110795ea0034f96606b8764885b
SHA11f3762e914114eec140fab47044c57858b65b0bc
SHA2565d9c4e8e3faa3b29bae31e970f1e08c004e2dab453dfdea2e16e7bc2c682eb75
SHA512aabc17566656ad7106265cd6a3a6956669e91272b457c5801d46be9ae1edd4824883d49a8a8d0dda7dfb0cb3805273e6632a585d7260f38c2675be5d2dc94d25
-
Filesize
774KB
MD5f16c7110795ea0034f96606b8764885b
SHA11f3762e914114eec140fab47044c57858b65b0bc
SHA2565d9c4e8e3faa3b29bae31e970f1e08c004e2dab453dfdea2e16e7bc2c682eb75
SHA512aabc17566656ad7106265cd6a3a6956669e91272b457c5801d46be9ae1edd4824883d49a8a8d0dda7dfb0cb3805273e6632a585d7260f38c2675be5d2dc94d25