Analysis
-
max time kernel
42s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06/11/2022, 08:16
Static task
static1
Behavioral task
behavioral1
Sample
86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe
Resource
win7-20220812-en
General
-
Target
86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe
-
Size
514KB
-
MD5
31b32a4b9868e2872e08cbc5edc6f1f0
-
SHA1
8b879e7d75a05b957a49740a302eec40d63630e3
-
SHA256
86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba
-
SHA512
f680e855961e791287472d78a6772e4725f1a2421182d0fd75ef546bff9b8082de446866515df7ca227da07e15fb5313070efea3a7d1a6173198b03905e01855
-
SSDEEP
12288:nh6Bo7lyUDyiFBpbH7Xxu8XhE9wOqWBKh7Ho0LVdM:kBo7bFvz7hhqwOqDHvfM
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 1140 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\help = "C:\\Users\\Admin\\AppData\\Roaming\\InstallDir\\help.exe" 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1140 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1140 wrote to memory of 1136 1140 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe 27 PID 1140 wrote to memory of 1136 1140 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe 27 PID 1140 wrote to memory of 1136 1140 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe 27 PID 1140 wrote to memory of 1136 1140 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe 27 PID 1140 wrote to memory of 1828 1140 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe 28 PID 1140 wrote to memory of 1828 1140 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe 28 PID 1140 wrote to memory of 1828 1140 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe 28 PID 1140 wrote to memory of 1828 1140 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe 28 PID 1140 wrote to memory of 1828 1140 86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe 28 PID 1136 wrote to memory of 1768 1136 cmd.exe 30 PID 1136 wrote to memory of 1768 1136 cmd.exe 30 PID 1136 wrote to memory of 1768 1136 cmd.exe 30 PID 1136 wrote to memory of 1768 1136 cmd.exe 30 PID 1768 wrote to memory of 976 1768 net.exe 31 PID 1768 wrote to memory of 976 1768 net.exe 31 PID 1768 wrote to memory of 976 1768 net.exe 31 PID 1768 wrote to memory of 976 1768 net.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe"C:\Users\Admin\AppData\Local\Temp\86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exe/c net stop MpsSvc2⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\net.exenet stop MpsSvc3⤵
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 stop MpsSvc4⤵PID:976
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exeC:\Users\Admin\AppData\Local\Temp\86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe2⤵PID:1828
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Users\Admin\AppData\Local\Temp\86661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba.exe
Filesize514KB
MD531b32a4b9868e2872e08cbc5edc6f1f0
SHA18b879e7d75a05b957a49740a302eec40d63630e3
SHA25686661c3207cf787d710602a9067d464b271b3e858946c1eab311d0eae74d5aba
SHA512f680e855961e791287472d78a6772e4725f1a2421182d0fd75ef546bff9b8082de446866515df7ca227da07e15fb5313070efea3a7d1a6173198b03905e01855