Analysis
-
max time kernel
32s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 16:42
Static task
static1
Behavioral task
behavioral1
Sample
dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe
Resource
win10v2004-20220812-en
General
-
Target
dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe
-
Size
289KB
-
MD5
042b3c3e18b912e89408eed3adbeea30
-
SHA1
5d9ef32afc702daff5c3efaa1ad3da91d24a81e8
-
SHA256
dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8
-
SHA512
dc5646752d12ba9c440fa125f76f8864606e62d407eef317e8b145c74a401d5225306c4325708dc0060d52b0f22d4eb07fecb11134ac9303bf0989fed7d34932
-
SSDEEP
3072:CME87tq3Ywm+iW3L2Bp6T7RLdvQHs4H7LOCodLnuDsWVFSymB/0L:Cs7twLnPRqsGLOCodahVFOBML
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
description ioc Process File opened for modification C:\WINDOWS\system32\UNREGMP2.EXE dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe -
Suspicious behavior: MapViewOfSection 21 IoCs
pid Process 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe Token: SeTakeOwnershipPrivilege 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe Token: SeRestorePrivilege 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe Token: SeBackupPrivilege 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe Token: SeChangeNotifyPrivilege 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 960 wrote to memory of 368 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 2 PID 960 wrote to memory of 368 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 2 PID 960 wrote to memory of 368 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 2 PID 960 wrote to memory of 368 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 2 PID 960 wrote to memory of 368 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 2 PID 960 wrote to memory of 368 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 2 PID 960 wrote to memory of 380 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 1 PID 960 wrote to memory of 380 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 1 PID 960 wrote to memory of 380 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 1 PID 960 wrote to memory of 380 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 1 PID 960 wrote to memory of 380 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 1 PID 960 wrote to memory of 380 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 1 PID 960 wrote to memory of 416 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 5 PID 960 wrote to memory of 416 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 5 PID 960 wrote to memory of 416 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 5 PID 960 wrote to memory of 416 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 5 PID 960 wrote to memory of 416 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 5 PID 960 wrote to memory of 416 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 5 PID 960 wrote to memory of 460 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 6 PID 960 wrote to memory of 460 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 6 PID 960 wrote to memory of 460 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 6 PID 960 wrote to memory of 460 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 6 PID 960 wrote to memory of 460 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 6 PID 960 wrote to memory of 460 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 6 PID 960 wrote to memory of 476 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 7 PID 960 wrote to memory of 476 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 7 PID 960 wrote to memory of 476 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 7 PID 960 wrote to memory of 476 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 7 PID 960 wrote to memory of 476 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 7 PID 960 wrote to memory of 476 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 7 PID 960 wrote to memory of 484 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 8 PID 960 wrote to memory of 484 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 8 PID 960 wrote to memory of 484 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 8 PID 960 wrote to memory of 484 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 8 PID 960 wrote to memory of 484 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 8 PID 960 wrote to memory of 484 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 8 PID 960 wrote to memory of 576 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 26 PID 960 wrote to memory of 576 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 26 PID 960 wrote to memory of 576 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 26 PID 960 wrote to memory of 576 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 26 PID 960 wrote to memory of 576 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 26 PID 960 wrote to memory of 576 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 26 PID 960 wrote to memory of 656 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 25 PID 960 wrote to memory of 656 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 25 PID 960 wrote to memory of 656 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 25 PID 960 wrote to memory of 656 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 25 PID 960 wrote to memory of 656 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 25 PID 960 wrote to memory of 656 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 25 PID 960 wrote to memory of 748 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 24 PID 960 wrote to memory of 748 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 24 PID 960 wrote to memory of 748 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 24 PID 960 wrote to memory of 748 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 24 PID 960 wrote to memory of 748 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 24 PID 960 wrote to memory of 748 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 24 PID 960 wrote to memory of 804 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 23 PID 960 wrote to memory of 804 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 23 PID 960 wrote to memory of 804 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 23 PID 960 wrote to memory of 804 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 23 PID 960 wrote to memory of 804 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 23 PID 960 wrote to memory of 804 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 23 PID 960 wrote to memory of 848 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 22 PID 960 wrote to memory of 848 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 22 PID 960 wrote to memory of 848 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 22 PID 960 wrote to memory of 848 960 dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe 22
Processes
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:380
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe2⤵PID:460
-
C:\Windows\system32\taskhost.exe"taskhost.exe"3⤵PID:1140
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe3⤵PID:1092
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation3⤵PID:740
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork3⤵PID:1056
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe3⤵PID:336
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService3⤵PID:108
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs3⤵PID:872
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService3⤵PID:848
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted3⤵PID:804
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted3⤵PID:748
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS3⤵PID:656
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch3⤵PID:576
-
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe2⤵PID:476
-
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵PID:484
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:416
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1996
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1296
-
C:\Users\Admin\AppData\Local\Temp\dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe"C:\Users\Admin\AppData\Local\Temp\dffc44bfb215fbfe43e7d4f7f141baf927687d54277e0d75b3f48a7c488e99f8.exe"2⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:960
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1240