Resubmissions
05-11-2022 19:59
221105-yqefyabgdl 1005-11-2022 19:56
221105-yn7dyabgcp 1005-11-2022 19:39
221105-ydcftabfgr 1005-11-2022 19:22
221105-x3ef2ahce6 10Analysis
-
max time kernel
600s -
max time network
433s -
platform
windows7_x64 -
resource
win7-20220812-de -
resource tags
arch:x64arch:x86image:win7-20220812-delocale:de-deos:windows7-x64systemwindows -
submitted
05-11-2022 19:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
Crack UZ1/DriverDoc.exe
Resource
win7-20220812-de
windows7-x64
0 signatures
600 seconds
Behavioral task
behavioral2
Sample
Crack UZ1/DriverDoc.exe
Resource
win10v2004-20220812-de
windows10-2004-x64
1 signatures
600 seconds
Behavioral task
behavioral3
Sample
Setup_DriverDoc_2022.exe
Resource
win7-20220812-de
windows7-x64
15 signatures
600 seconds
Behavioral task
behavioral4
Sample
Setup_DriverDoc_2022.exe
Resource
win10v2004-20220812-de
windows10-2004-x64
21 signatures
600 seconds
General
-
Target
Setup_DriverDoc_2022.exe
-
Size
6.0MB
-
MD5
c65a354ac28f2f45c7ca8a38e4f778d6
-
SHA1
42d84f6be5cfa1503dc7bd8275073872d71a4fc0
-
SHA256
396cb9e17c57f09c4afab97f91e72011e3f115b15e764c39d26473d92fe2c45e
-
SHA512
7acba2651fb1378a97c47ce6723808235ddd74d2cb736f5fb6f28a241f3b33188e9a511c6be2eb3ca8e7cad68c05a76a0c853edc5a417a16aacd5c0388950017
-
SSDEEP
98304:KSi1jH0UJukUYMwioEgGU9KM+ZFNIO05p0oO2gz8+fyTx:MUvkUMiij9KM+7Npc0R4+KTx
Score
9/10
Malware Config
Signatures
-
Affect hook table 3 IoCs
resource yara_rule behavioral3/files/0x000a000000012329-57.dat win_hook behavioral3/files/0x000a000000012329-59.dat win_hook behavioral3/files/0x000a000000012329-64.dat win_hook -
Bypass DEP 7 IoCs
resource yara_rule behavioral3/memory/272-55-0x0000000000400000-0x00000000004E4000-memory.dmp disable_dep behavioral3/files/0x000a000000012329-57.dat disable_dep behavioral3/files/0x000a000000012329-59.dat disable_dep behavioral3/memory/272-60-0x0000000000400000-0x00000000004E4000-memory.dmp disable_dep behavioral3/memory/272-62-0x0000000000400000-0x00000000004E4000-memory.dmp disable_dep behavioral3/files/0x000a000000012329-64.dat disable_dep behavioral3/memory/1700-65-0x0000000140000000-0x00000001405E8000-memory.dmp disable_dep -
Checks if being debugged 3 IoCs
resource yara_rule behavioral3/files/0x000a000000012329-57.dat anti_dbg behavioral3/files/0x000a000000012329-59.dat anti_dbg behavioral3/files/0x000a000000012329-64.dat anti_dbg -
DebuggerException__SetConsoleCtrl 3 IoCs
resource yara_rule behavioral3/files/0x000a000000012329-57.dat DebuggerException__SetConsoleCtrl behavioral3/files/0x000a000000012329-59.dat DebuggerException__SetConsoleCtrl behavioral3/files/0x000a000000012329-64.dat DebuggerException__SetConsoleCtrl -
SEH_Init 3 IoCs
resource yara_rule behavioral3/files/0x000a000000012329-57.dat SEH_Init behavioral3/files/0x000a000000012329-59.dat SEH_Init behavioral3/files/0x000a000000012329-64.dat SEH_Init -
SEH_Save 3 IoCs
resource yara_rule behavioral3/files/0x000a000000012329-57.dat SEH_Save behavioral3/files/0x000a000000012329-59.dat SEH_Save behavioral3/files/0x000a000000012329-64.dat SEH_Save -
Executes dropped EXE 1 IoCs
pid Process 2040 Setup_DriverDoc_2022.tmp -
Loads dropped DLL 1 IoCs
pid Process 272 Setup_DriverDoc_2022.exe -
Modifies registry class 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings taskmgr.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\MuiCache taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 1700 taskmgr.exe 2040 Setup_DriverDoc_2022.tmp -
Suspicious use of AdjustPrivilegeToken 9 IoCs
description pid Process Token: SeDebugPrivilege 1700 taskmgr.exe Token: SeSecurityPrivilege 1700 taskmgr.exe Token: SeTakeOwnershipPrivilege 1700 taskmgr.exe Token: SeSecurityPrivilege 1700 taskmgr.exe Token: SeTakeOwnershipPrivilege 1700 taskmgr.exe Token: 33 280 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 280 AUDIODG.EXE Token: 33 280 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 280 AUDIODG.EXE -
Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
pid Process 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe 1700 taskmgr.exe -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 272 wrote to memory of 2040 272 Setup_DriverDoc_2022.exe 27 PID 272 wrote to memory of 2040 272 Setup_DriverDoc_2022.exe 27 PID 272 wrote to memory of 2040 272 Setup_DriverDoc_2022.exe 27 PID 272 wrote to memory of 2040 272 Setup_DriverDoc_2022.exe 27 PID 272 wrote to memory of 2040 272 Setup_DriverDoc_2022.exe 27 PID 272 wrote to memory of 2040 272 Setup_DriverDoc_2022.exe 27 PID 272 wrote to memory of 2040 272 Setup_DriverDoc_2022.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2022.exe"C:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2022.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:272 -
C:\Users\Admin\AppData\Local\Temp\is-VUADU.tmp\Setup_DriverDoc_2022.tmp"C:\Users\Admin\AppData\Local\Temp\is-VUADU.tmp\Setup_DriverDoc_2022.tmp" /SL5="$60130,5347251,879104,C:\Users\Admin\AppData\Local\Temp\Setup_DriverDoc_2022.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2040
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1700
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"1⤵PID:584
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x4501⤵
- Suspicious use of AdjustPrivilegeToken
PID:280
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3.1MB
MD5d70a98daf7a810ee18ce451ec673e399
SHA1274dff37313f3fbdf82dfc4afd94582359b79fee
SHA2569621346beee2a257b1966b6dc3f1f850d54ae0746bf1718d35c966649ac9b340
SHA512a246aa8979a7bc1a8ae6d1c5ac637939e7ab3380484cb78a3fc98fe9ceccb51cb5d6dfe787ece6bb1420450741c0734a049849dac7242679b8660e71acf00e60
-
Filesize
3.1MB
MD5d70a98daf7a810ee18ce451ec673e399
SHA1274dff37313f3fbdf82dfc4afd94582359b79fee
SHA2569621346beee2a257b1966b6dc3f1f850d54ae0746bf1718d35c966649ac9b340
SHA512a246aa8979a7bc1a8ae6d1c5ac637939e7ab3380484cb78a3fc98fe9ceccb51cb5d6dfe787ece6bb1420450741c0734a049849dac7242679b8660e71acf00e60
-
Filesize
3.1MB
MD5d70a98daf7a810ee18ce451ec673e399
SHA1274dff37313f3fbdf82dfc4afd94582359b79fee
SHA2569621346beee2a257b1966b6dc3f1f850d54ae0746bf1718d35c966649ac9b340
SHA512a246aa8979a7bc1a8ae6d1c5ac637939e7ab3380484cb78a3fc98fe9ceccb51cb5d6dfe787ece6bb1420450741c0734a049849dac7242679b8660e71acf00e60