Analysis
-
max time kernel
123s -
max time network
103s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 04:46
Static task
static1
Behavioral task
behavioral1
Sample
bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe
-
Size
31KB
-
MD5
09bc1d1496d8b9f95c980449c7b47dd2
-
SHA1
7e7d0974c77d2f86e0d3e4e2888780c7b5d6ee59
-
SHA256
bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3
-
SHA512
27139faff2e9226a46e7fedbd087fe6d77fa657ce7f8aa870468923436558f9bdad958e35f9319b0a315b0af84e67f49f856ab1920ede9132fbb1da5738b1efe
-
SSDEEP
768:wL/tTpH9fr5+/yJoVOMTaj7GJDHUlIr5mdnbcuyD7UIuZ:6t59fr+gljqHUyFgnouy8DZ
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 1 IoCs
pid Process 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\360se = "C:\\Users\\Admin\\AppData\\Local\\Temp\\bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe" bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\s: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\z: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\m: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\o: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\p: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\t: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\w: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\x: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\g: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\k: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\n: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\l: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\r: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\y: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\e: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\h: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\i: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\u: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\v: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\f: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\j: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened (read-only) \??\q: bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\7105283.DEP bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\rhdltecq\oioifz.pif bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe File opened for modification C:\Program Files (x86)\Common Files\rhdltecq\oioifz.pif bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1984 sc.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe Token: SeDebugPrivilege 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1648 wrote to memory of 1280 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 27 PID 1648 wrote to memory of 1280 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 27 PID 1648 wrote to memory of 1280 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 27 PID 1648 wrote to memory of 1280 1648 bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe 27 PID 1280 wrote to memory of 1984 1280 cmd.exe 29 PID 1280 wrote to memory of 1984 1280 cmd.exe 29 PID 1280 wrote to memory of 1984 1280 cmd.exe 29 PID 1280 wrote to memory of 1984 1280 cmd.exe 29 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe"C:\Users\Admin\AppData\Local\Temp\bd73c4c13ebc824c10c9d1aa4a6bb377093b484ddafcf09a47ec0b89ef8f45d3.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1648 -
C:\Windows\SysWOW64\cmd.execmd /c sc stop policyagent2⤵
- Suspicious use of WriteProcessMemory
PID:1280 -
C:\Windows\SysWOW64\sc.exesc stop policyagent3⤵
- Launches sc.exe
PID:1984
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.1MB
MD53531c067617b03c2de4e736fe75d9dd3
SHA1c6454192d9c21e2920336e1b64a5075f200932e5
SHA256617a06e1129b74951815bb0e48842d69726b46a5d4a7b1cc4dd96bdf0f534a43
SHA512e0da5e95d70208852037db1357fdce1bbd7c509c400a0100e0b20a3367b6d7b3a2ba82cd3e60643c93985f1580e438c84f5986bfa0990aba11c4530aaf423c5b