fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e

Analysis

max time kernel
149s
max time network
50s
platform
windows7_x64
resource
win7-20220901-en
resource tags

arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
submitted
30/10/2022, 21:10

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe
Size

964KB
MD5

91ba801687891f77aff01ae05fd9fcd0
SHA1

8ddc990c808517f7158170f60bfddcdbbf25ead1
SHA256

fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e
SHA512

a067ce96024efec5a697e8eeecf0876b9e9f872d7f7050a491634cedcadc0d386d5bb685289f2f9697e52a503e3b230a0f58c1af56dda141643c4d2ef82aeda0
SSDEEP

6144:TzASTZtaKSpwmx5ATm/LC3fwf3OoU9xkYSr/mdBTRhKWIjsRP/1HHm/hHAM8i6ry:PzZxSpwmxvL/f3vCN1PMaLi6rAyIQj8

Score

8^/10

Malware Config

Signatures

Drops file in Drivers directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\lsass.exe	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe
File created	C:\Windows\SysWOW64\drivers\lsass.exe	lsass.exe

Executes dropped EXE 2 IoCs

pid	Process
940	lsass.exe
896	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\~.pif	lsass.exe

Loads dropped DLL 6 IoCs

pid	Process
1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe
1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe
1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe
896	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp
896	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp
896	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp

Enumerates connected drives 3 TTPs 1 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\E:	lsass.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\DPINST.LOG	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe
1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe
940	lsass.exe
940	lsass.exe

Suspicious use of WriteProcessMemory 11 IoCs

description	pid	Process	procid_target
PID 1368 wrote to memory of 940	1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe	27
PID 1368 wrote to memory of 940	1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe	27
PID 1368 wrote to memory of 940	1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe	27
PID 1368 wrote to memory of 940	1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe	27
PID 1368 wrote to memory of 896	1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe	28
PID 1368 wrote to memory of 896	1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe	28
PID 1368 wrote to memory of 896	1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe	28
PID 1368 wrote to memory of 896	1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe	28
PID 1368 wrote to memory of 896	1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe	28
PID 1368 wrote to memory of 896	1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe	28
PID 1368 wrote to memory of 896	1368	fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe	28

C:\Users\Admin\AppData\Local\Temp\fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe
"C:\Users\Admin\AppData\Local\Temp\fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.exe"
1⤵
- Drops file in Drivers directory
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1368
- C:\Windows\SysWOW64\drivers\lsass.exe
  "C:\Windows\system32\drivers\lsass.exe"
  2⤵
  - Drops file in Drivers directory
  - Executes dropped EXE
  - Drops startup file
  - Enumerates connected drives
  - Suspicious use of SetWindowsHookEx
  PID:940
- C:\Users\Admin\AppData\Local\Temp\fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp
  "C:\Users\Admin\AppData\Local\Temp\fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp "
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Drops file in Windows directory
  PID:896

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp

Filesize
900KB

MD5
e6213cec602f332bf8e868b7b8bf2bb1

SHA1
593775390b8a474a0bdb8a49b5d26b50b6e3cace

SHA256
4478f6fcfd2fc9be012668592bfbf6838a115d983f9d30171669b20cafe529b9

SHA512
24f96cd7a5043547997167f46c32381ca86932fe7d3a9cf32edd72e7a0cc0fa165152246da913c56d124d1f821e00f09872aa0e3dff23b655e83d9676e14482f

Download Submit
C:\Users\Admin\AppData\Local\Temp\fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp

Filesize
900KB

MD5
e6213cec602f332bf8e868b7b8bf2bb1

SHA1
593775390b8a474a0bdb8a49b5d26b50b6e3cace

SHA256
4478f6fcfd2fc9be012668592bfbf6838a115d983f9d30171669b20cafe529b9

SHA512
24f96cd7a5043547997167f46c32381ca86932fe7d3a9cf32edd72e7a0cc0fa165152246da913c56d124d1f821e00f09872aa0e3dff23b655e83d9676e14482f

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
669ffd1dd6fb7a0e4ddbc3ad3b76507b

SHA1
372820d6b9350ad629a489d49876d8bd422b8f31

SHA256
7dc487e762e55ffa601480c4bc7948f85fcd4f025665ff599060ec1f81d7e986

SHA512
cd69694ad3316c768dbe0d1514060870568c67a50785b38d402eb16e94740c5ae351eb6d47284630a2505fac50c9777bedef85608571c85385b1b9c1f12d73f5

Download Submit
C:\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
669ffd1dd6fb7a0e4ddbc3ad3b76507b

SHA1
372820d6b9350ad629a489d49876d8bd422b8f31

SHA256
7dc487e762e55ffa601480c4bc7948f85fcd4f025665ff599060ec1f81d7e986

SHA512
cd69694ad3316c768dbe0d1514060870568c67a50785b38d402eb16e94740c5ae351eb6d47284630a2505fac50c9777bedef85608571c85385b1b9c1f12d73f5

Download Submit
\Users\Admin\AppData\Local\Temp\fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp

Filesize
900KB

MD5
e6213cec602f332bf8e868b7b8bf2bb1

SHA1
593775390b8a474a0bdb8a49b5d26b50b6e3cace

SHA256
4478f6fcfd2fc9be012668592bfbf6838a115d983f9d30171669b20cafe529b9

SHA512
24f96cd7a5043547997167f46c32381ca86932fe7d3a9cf32edd72e7a0cc0fa165152246da913c56d124d1f821e00f09872aa0e3dff23b655e83d9676e14482f

Download Submit
\Users\Admin\AppData\Local\Temp\fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp

Filesize
900KB

MD5
e6213cec602f332bf8e868b7b8bf2bb1

SHA1
593775390b8a474a0bdb8a49b5d26b50b6e3cace

SHA256
4478f6fcfd2fc9be012668592bfbf6838a115d983f9d30171669b20cafe529b9

SHA512
24f96cd7a5043547997167f46c32381ca86932fe7d3a9cf32edd72e7a0cc0fa165152246da913c56d124d1f821e00f09872aa0e3dff23b655e83d9676e14482f

Download Submit
\Users\Admin\AppData\Local\Temp\fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp

Filesize
900KB

MD5
e6213cec602f332bf8e868b7b8bf2bb1

SHA1
593775390b8a474a0bdb8a49b5d26b50b6e3cace

SHA256
4478f6fcfd2fc9be012668592bfbf6838a115d983f9d30171669b20cafe529b9

SHA512
24f96cd7a5043547997167f46c32381ca86932fe7d3a9cf32edd72e7a0cc0fa165152246da913c56d124d1f821e00f09872aa0e3dff23b655e83d9676e14482f

Download Submit
\Users\Admin\AppData\Local\Temp\fcae1f4ac63372d236f64ff529efac471e132ca67a625446afd02ef56883f78e.~tmp

Filesize
900KB

MD5
e6213cec602f332bf8e868b7b8bf2bb1

SHA1
593775390b8a474a0bdb8a49b5d26b50b6e3cace

SHA256
4478f6fcfd2fc9be012668592bfbf6838a115d983f9d30171669b20cafe529b9

SHA512
24f96cd7a5043547997167f46c32381ca86932fe7d3a9cf32edd72e7a0cc0fa165152246da913c56d124d1f821e00f09872aa0e3dff23b655e83d9676e14482f

Download Submit
\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
669ffd1dd6fb7a0e4ddbc3ad3b76507b

SHA1
372820d6b9350ad629a489d49876d8bd422b8f31

SHA256
7dc487e762e55ffa601480c4bc7948f85fcd4f025665ff599060ec1f81d7e986

SHA512
cd69694ad3316c768dbe0d1514060870568c67a50785b38d402eb16e94740c5ae351eb6d47284630a2505fac50c9777bedef85608571c85385b1b9c1f12d73f5

Download Submit
\Windows\SysWOW64\drivers\lsass.exe

Filesize
32KB

MD5
669ffd1dd6fb7a0e4ddbc3ad3b76507b

SHA1
372820d6b9350ad629a489d49876d8bd422b8f31

SHA256
7dc487e762e55ffa601480c4bc7948f85fcd4f025665ff599060ec1f81d7e986

SHA512
cd69694ad3316c768dbe0d1514060870568c67a50785b38d402eb16e94740c5ae351eb6d47284630a2505fac50c9777bedef85608571c85385b1b9c1f12d73f5

Download Submit
memory/1368-54-0x0000000074E41000-0x0000000074E43000-memory.dmp

Filesize
8KB

Download