Analysis
-
max time kernel
37s -
max time network
41s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30-10-2022 21:06
Static task
static1
Behavioral task
behavioral1
Sample
ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe
Resource
win10v2004-20220901-en
General
-
Target
ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe
-
Size
219KB
-
MD5
9189035b9e47a841a11252bf3bef9100
-
SHA1
648a10aeeb97db5b8da32ab26f33898ea7e1a139
-
SHA256
ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007
-
SHA512
e8a59e8b51a76f9011166aae791d417e720223f44bb00d48d2811ba97d91e69a46e3d1b7c497eac59f9fa8e70c244b4dcb03e516b520aaff523d0bada9160bfb
-
SSDEEP
3072:NdKFOoL162F8ZXYekhriiiv/ktZqLFpWkm3U3np6wo/0or04tBRc9:7KF/LAaMYZhriiiHkujnm3kow0rVRc9
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1620 ctxmon.exe -
Loads dropped DLL 1 IoCs
pid Process 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe -
Adds Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe" ctxmon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\yazzz = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ctxmon.exe" ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ctxmon.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\atitool = "C:\\Users\\Admin\\AppData\\Roaming\\pwrwin.exe" ctxmon.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run ctxmon.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe -
Suspicious behavior: MapViewOfSection 21 IoCs
pid Process 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1612 wrote to memory of 1620 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 26 PID 1612 wrote to memory of 1620 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 26 PID 1612 wrote to memory of 1620 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 26 PID 1612 wrote to memory of 1620 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 26 PID 1612 wrote to memory of 368 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 5 PID 1612 wrote to memory of 368 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 5 PID 1612 wrote to memory of 368 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 5 PID 1612 wrote to memory of 368 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 5 PID 1612 wrote to memory of 368 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 5 PID 1612 wrote to memory of 368 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 5 PID 1612 wrote to memory of 368 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 5 PID 1612 wrote to memory of 380 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 4 PID 1612 wrote to memory of 380 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 4 PID 1612 wrote to memory of 380 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 4 PID 1612 wrote to memory of 380 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 4 PID 1612 wrote to memory of 380 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 4 PID 1612 wrote to memory of 380 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 4 PID 1612 wrote to memory of 380 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 4 PID 1612 wrote to memory of 420 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 3 PID 1612 wrote to memory of 420 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 3 PID 1612 wrote to memory of 420 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 3 PID 1612 wrote to memory of 420 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 3 PID 1612 wrote to memory of 420 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 3 PID 1612 wrote to memory of 420 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 3 PID 1612 wrote to memory of 420 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 3 PID 1612 wrote to memory of 468 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 2 PID 1612 wrote to memory of 468 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 2 PID 1612 wrote to memory of 468 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 2 PID 1612 wrote to memory of 468 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 2 PID 1612 wrote to memory of 468 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 2 PID 1612 wrote to memory of 468 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 2 PID 1612 wrote to memory of 468 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 2 PID 1612 wrote to memory of 476 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1 PID 1612 wrote to memory of 476 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1 PID 1612 wrote to memory of 476 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1 PID 1612 wrote to memory of 476 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1 PID 1612 wrote to memory of 476 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1 PID 1612 wrote to memory of 476 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1 PID 1612 wrote to memory of 476 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 1 PID 1612 wrote to memory of 484 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 24 PID 1612 wrote to memory of 484 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 24 PID 1612 wrote to memory of 484 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 24 PID 1612 wrote to memory of 484 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 24 PID 1612 wrote to memory of 484 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 24 PID 1612 wrote to memory of 484 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 24 PID 1612 wrote to memory of 484 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 24 PID 1612 wrote to memory of 584 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 8 PID 1612 wrote to memory of 584 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 8 PID 1612 wrote to memory of 584 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 8 PID 1612 wrote to memory of 584 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 8 PID 1612 wrote to memory of 584 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 8 PID 1612 wrote to memory of 584 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 8 PID 1612 wrote to memory of 584 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 8 PID 1612 wrote to memory of 660 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 23 PID 1612 wrote to memory of 660 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 23 PID 1612 wrote to memory of 660 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 23 PID 1612 wrote to memory of 660 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 23 PID 1612 wrote to memory of 660 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 23 PID 1612 wrote to memory of 660 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 23 PID 1612 wrote to memory of 660 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 23 PID 1612 wrote to memory of 740 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 22 PID 1612 wrote to memory of 740 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 22 PID 1612 wrote to memory of 740 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 22 PID 1612 wrote to memory of 740 1612 ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe 22
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:476
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:584
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:292
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:752
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1792
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1240
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1036
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:284
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:868
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:844
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:804
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:740
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:660
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:380
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1320
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1356
-
C:\Users\Admin\AppData\Local\Temp\ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe"C:\Users\Admin\AppData\Local\Temp\ab11fd7bf7ec4ec5fcd74df6ae85147a5c656c01b984b80c849f140e410bc007.exe"2⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1612 -
C:\Users\Admin\AppData\Local\Temp\ctxmon.exeC:\Users\Admin\AppData\Local\Temp\ctxmon.exe3⤵
- Executes dropped EXE
- Adds Run key to start application
PID:1620
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
115KB
MD5b41dd2240b072ec09744353fc20b7f83
SHA133ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8
SHA2562b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3
SHA5128fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1
-
Filesize
115KB
MD5b41dd2240b072ec09744353fc20b7f83
SHA133ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8
SHA2562b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3
SHA5128fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1
-
Filesize
115KB
MD5b41dd2240b072ec09744353fc20b7f83
SHA133ffb4d4d4cb3e38b674d71abef6e9946b0cf9a8
SHA2562b8614f538c2d60ff88db94992fd42f938e444d0074308f8a02f3e7d7e38c3d3
SHA5128fcc0366f7ea38b474205a6f9e1a0e7ca41dfc16be59e5c06b72eed32b83fb1936bbe1a2b9d77231dcff06d615347e51e9d0e7ec3f8fad31f42d1b4829adedd1