7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0

Analysis

max time kernel
152s
max time network
42s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
29/10/2022, 01:44

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0.exe
Size

61KB
MD5

0cd3ad42e245df6e349e69135630cad6
SHA1

a2b3ada0e01dc60af5929429dcb73d4a4ac6a401
SHA256

7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0
SHA512

3b22e46e4843859ff5841a3ceaccef84ab9d1d1dc7d8add962b84e77f34104cdd33f717c607b46b467b0cec114b118532d6440ae66050e767b5ecbc60c8ad955
SSDEEP

1536:P1P001j6aYzkToNGFu4rzu8b2TJeUgs5wpyanjg:d809JYeoWu4v6TbUtjg

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\ujvgzi.sys	7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0.exe

Sets DLL path for service in the registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet003\Services\tcqezb\Parameters\ServiceDll = "%SystemRoot%\\System32\\ujvgzi.dll"	7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\tcqezb\Parameters\ServiceDll = "%SystemRoot%\\System32\\ujvgzi.dll"	7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet002\services\tcqezb\Parameters\ServiceDll = "%SystemRoot%\\System32\\ujvgzi.dll"	7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0.exe

Deletes itself 1 IoCs

pid	Process
940	svchost.exe

Loads dropped DLL 2 IoCs

pid	Process
1368	7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0.exe
940	svchost.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\00052e2b.inf	7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0.exe
File created	C:\Windows\SysWOW64\ujvgzi.dll	7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0.exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
464	Process not Found

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
940	svchost.exe
940	svchost.exe
940	svchost.exe

C:\Users\Admin\AppData\Local\Temp\7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0.exe
"C:\Users\Admin\AppData\Local\Temp\7b370fc41f2c24e210907c07b080ee7e692e1047d21973af376539eb20eb67e0.exe"
1⤵
- Drops file in Drivers directory
- Sets DLL path for service in the registry
- Loads dropped DLL
- Drops file in System32 directory
PID:1368

C:\Windows\SysWOW64\svchost.exe
C:\Windows\SysWOW64\svchost.exe -k tcqezb
1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:940

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\ujvgzi.dll

Filesize
88KB

MD5
37a897b0bca1c2a9f59aac0f1a59259e

SHA1
0cb9b9cd2ac7257564131645fdecdd7eec1b11a6

SHA256
9a6ec95761a122736ee40b61a813a271207970700dc0fe6746ce472803398ad2

SHA512
0e8ceee726b25595e6a0a247a292e37b7f095a1b05680c409e1af04037f70029ee32ba89ed18438b555d0feeffc64c83d7e190121bc197559ea5442d16f35811

Download Submit
\Windows\SysWOW64\ujvgzi.dll

Filesize
88KB

MD5
37a897b0bca1c2a9f59aac0f1a59259e

SHA1
0cb9b9cd2ac7257564131645fdecdd7eec1b11a6

SHA256
9a6ec95761a122736ee40b61a813a271207970700dc0fe6746ce472803398ad2

SHA512
0e8ceee726b25595e6a0a247a292e37b7f095a1b05680c409e1af04037f70029ee32ba89ed18438b555d0feeffc64c83d7e190121bc197559ea5442d16f35811

Download Submit
\Windows\SysWOW64\ujvgzi.dll

Filesize
88KB

MD5
37a897b0bca1c2a9f59aac0f1a59259e

SHA1
0cb9b9cd2ac7257564131645fdecdd7eec1b11a6

SHA256
9a6ec95761a122736ee40b61a813a271207970700dc0fe6746ce472803398ad2

SHA512
0e8ceee726b25595e6a0a247a292e37b7f095a1b05680c409e1af04037f70029ee32ba89ed18438b555d0feeffc64c83d7e190121bc197559ea5442d16f35811

Download Submit
memory/1368-55-0x0000000076071000-0x0000000076073000-memory.dmp

Filesize
8KB

Download