Analysis
-
max time kernel
145s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-10-2022 13:16
Behavioral task
behavioral1
Sample
23f32813a91afec2a9c7700afaf4eb61.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
General
-
Target
23f32813a91afec2a9c7700afaf4eb61.exe
-
Size
202KB
-
MD5
23f32813a91afec2a9c7700afaf4eb61
-
SHA1
aa2056b984932988a359540363c7eb2d0d1fc2d6
-
SHA256
92f859040dd84bd2bd41803c5c22f373511ffe7c5c9113bae74653b28a9592bc
-
SHA512
c68123aa15783d1316a94377cfb55c417d7970a989daa3889e6b69399173fd785807a3eaa7181d7b191815befecbc5d150d5d210cb5c4328c8cb75c568fcdd1c
-
SSDEEP
6144:QLV6Bta6dtJmakIM5hlE4UXkD2rovrO6mlOZ:QLV6BtpmkS24ttvr5Z
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
23f32813a91afec2a9c7700afaf4eb61.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NTFS Monitor = "C:\\Program Files (x86)\\NTFS Monitor\\ntfsmon.exe" 23f32813a91afec2a9c7700afaf4eb61.exe -
Processes:
23f32813a91afec2a9c7700afaf4eb61.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 23f32813a91afec2a9c7700afaf4eb61.exe -
Drops file in Program Files directory 2 IoCs
Processes:
23f32813a91afec2a9c7700afaf4eb61.exedescription ioc process File created C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe 23f32813a91afec2a9c7700afaf4eb61.exe File opened for modification C:\Program Files (x86)\NTFS Monitor\ntfsmon.exe 23f32813a91afec2a9c7700afaf4eb61.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
23f32813a91afec2a9c7700afaf4eb61.exepid process 1980 23f32813a91afec2a9c7700afaf4eb61.exe 1980 23f32813a91afec2a9c7700afaf4eb61.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
23f32813a91afec2a9c7700afaf4eb61.exepid process 1980 23f32813a91afec2a9c7700afaf4eb61.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
23f32813a91afec2a9c7700afaf4eb61.exedescription pid process Token: SeDebugPrivilege 1980 23f32813a91afec2a9c7700afaf4eb61.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23f32813a91afec2a9c7700afaf4eb61.exe"C:\Users\Admin\AppData\Local\Temp\23f32813a91afec2a9c7700afaf4eb61.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken