Analysis
- max time kernel
203s - max time network
205s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
29/10/2022, 19:09
Behavioral task
behavioral1
Sample
d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe
- Size 281KB
- Sample221029-xtzqlsbcg5
- SHA256 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0
- MD5 a38418d791a4c917dc15f8956bac6f8e
- SHA1 c83d84198b9ea2efb0057d677bfc98c956ee7f58
- SHA512 0646ca6d101bd582c8fa041ae3b41af8604a1d6f2ea5d245c1d253e43dd4e6a35564021cc0f17098bc80875b50c966a9fc6b2b2cf7ae9e25fc898bada887f1c1
- SSDEEP 6144:+y+ph6TwlTIBgFUQ23QIKPhzD61+XEQY48T:7+pM0lIBgMAfN214lO
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Program Files (x86)\\install\\update.exe" d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Policies = "C:\\Program Files (x86)\\install\\update.exe" d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe - Modifies Installed Components in the registry 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Active Setup\Installed Components\{2VC3376S-YC07-65L8-1QS8-18T673ISBPYU} d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{2VC3376S-YC07-65L8-1QS8-18T673ISBPYU}\StubPath = "C:\\Program Files (x86)\\install\\update.exe Restart" d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe -
resource yara_rule behavioral2/memory/1240-133-0x0000000010410000-0x0000000010482000-memory.dmp upx behavioral2/memory/1240-138-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral2/memory/4916-141-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral2/memory/4916-142-0x0000000010490000-0x0000000010502000-memory.dmp upx behavioral2/memory/4916-144-0x0000000010490000-0x0000000010502000-memory.dmp upx - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\HKLM = "C:\\Program Files (x86)\\install\\update.exe" d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\Software\Microsoft\Windows\CurrentVersion\Run d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\HKCU = "C:\\Program Files (x86)\\install\\update.exe" d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe - Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\install\update.exe d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe File opened for modification C:\Program Files (x86)\install\update.exe d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4916 explorer.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeBackupPrivilege 4916 explorer.exe Token: SeRestorePrivilege 4916 explorer.exe Token: SeDebugPrivilege 4916 explorer.exe Token: SeDebugPrivilege 4916 explorer.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe - Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30 PID 1240 wrote to memory of 600 1240 d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe"C:\Users\Admin\AppData\Local\Temp\d568d806301bd08594ee43bc1a0f64116e60e2f9ff6feac380b714d3c8bb7fd0.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1240 -
C:\Windows\SysWOW64\explorer.exeexplorer.exe2⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
PID:4916
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:600
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Admin2.txt
- Size 238KB
- SHA256 3357d28933a12de4f9ac225a3255249d02178ac7431c6cb3e6bc773287b9f8c9
- MD5 0530ef117d15ea77cc3ee441e12d3ce7
- SHA1 64b9ba4c89225f367ac98f4ce7f91a127f19b617
- SHA512 538ab023190fb537240e8abf0efe189b501ce0093248c64b031ec5588b560086f244d3226ac8b89297845db1823e5a341a9b0ed73cbbe55fe63113fd6cfc0c6c
- SSDEEP 3072:olBTqj69GmGyuIul8c7LT5g1fBBgVAVm+s7UsrVajNZ3QoV7ERTPhsYVlGw6wDST:iTwlTIBgFUQ23QIKPhzD61+XEQY48b
- MD5 SHA1 SHA512 SSDEEP