Analysis
-
max time kernel
132s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 09:58
Behavioral task
behavioral1
Sample
e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe
Resource
win10v2004-20220901-en
General
-
Target
e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe
-
Size
121KB
-
MD5
0d651f176a0f1b2659a0f6f578ceb1f1
-
SHA1
198b746ca2c0272e03717c52fe089716313ae62c
-
SHA256
e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66
-
SHA512
171f6d8c2fce3cdd4b59de425266e9770e0a248d9f7a39d201e341b86d02b6dcca20ba685450be3e3a45f67e5e1a300ed414166cbeadd189b545b630ce5cd44e
-
SSDEEP
3072:0tJ6Ypo3U3zGNCgDvKz1jYjfiS4dTCGv:m83iaCgDymP6Cc
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1720 mspaint.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run mspaint.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lvpopz = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Lvpopz.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\D: mspaint.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1696 set thread context of 1960 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 28 -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\Debug\WIA\wiatrace.log mspaint.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IntelliForms IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\BrowserEmulation\LowMic IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\NextUpdateDate = "374628067" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\ IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser IEXPLORE.EXE Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\Window_Placement = 2c0000000200000003000000ffffffffffffffffffffffffffffffff2400000024000000aa04000089020000 IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\PageSetup IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\InternetRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\GPU IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Zoom IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\PendingRecovery\AdminActive = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DontShowMeThisDialogAgain IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\FullScreen = "no" IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\CompatibilityFlags = "0" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive IEXPLORE.EXE Set value (int) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Recovery\AdminActive\{72706311-5EF2-11ED-A20B-4279513DF160} = "0" IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames IEXPLORE.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\DomainSuggestion\FileNames\en-US = "en-US.1" IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\IETld\LowMic IEXPLORE.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Internet Explorer\LowRegistry\DOMStorage IEXPLORE.EXE -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe Token: SeDebugPrivilege 940 svchost.exe Token: SeDebugPrivilege 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe Token: SeDebugPrivilege 1720 mspaint.exe Token: SeDebugPrivilege 1092 IEXPLORE.EXE -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 992 IEXPLORE.EXE -
Suspicious use of SetWindowsHookEx 10 IoCs
pid Process 1720 mspaint.exe 1720 mspaint.exe 1720 mspaint.exe 1720 mspaint.exe 992 IEXPLORE.EXE 992 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE 1092 IEXPLORE.EXE -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1696 wrote to memory of 940 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 27 PID 1696 wrote to memory of 940 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 27 PID 1696 wrote to memory of 940 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 27 PID 1696 wrote to memory of 940 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 27 PID 1696 wrote to memory of 940 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 27 PID 1696 wrote to memory of 940 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 27 PID 1696 wrote to memory of 940 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 27 PID 1696 wrote to memory of 1960 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 28 PID 1696 wrote to memory of 1960 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 28 PID 1696 wrote to memory of 1960 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 28 PID 1696 wrote to memory of 1960 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 28 PID 1696 wrote to memory of 1960 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 28 PID 1696 wrote to memory of 1960 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 28 PID 1696 wrote to memory of 1960 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 28 PID 1696 wrote to memory of 1960 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 28 PID 1696 wrote to memory of 1960 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 28 PID 1696 wrote to memory of 1960 1696 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 28 PID 940 wrote to memory of 1720 940 svchost.exe 29 PID 940 wrote to memory of 1720 940 svchost.exe 29 PID 940 wrote to memory of 1720 940 svchost.exe 29 PID 940 wrote to memory of 1720 940 svchost.exe 29 PID 1960 wrote to memory of 1196 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 31 PID 1960 wrote to memory of 1196 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 31 PID 1960 wrote to memory of 1196 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 31 PID 1960 wrote to memory of 1196 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 31 PID 1196 wrote to memory of 992 1196 iexplore.exe 32 PID 1196 wrote to memory of 992 1196 iexplore.exe 32 PID 1196 wrote to memory of 992 1196 iexplore.exe 32 PID 1196 wrote to memory of 992 1196 iexplore.exe 32 PID 992 wrote to memory of 1092 992 IEXPLORE.EXE 34 PID 992 wrote to memory of 1092 992 IEXPLORE.EXE 34 PID 992 wrote to memory of 1092 992 IEXPLORE.EXE 34 PID 992 wrote to memory of 1092 992 IEXPLORE.EXE 34 PID 1960 wrote to memory of 940 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 27 PID 1960 wrote to memory of 940 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 27 PID 1960 wrote to memory of 1720 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 29 PID 1960 wrote to memory of 1720 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 29 PID 1960 wrote to memory of 1092 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 34 PID 1960 wrote to memory of 1092 1960 e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe 34
Processes
-
C:\Users\Admin\AppData\Local\Temp\e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe"C:\Users\Admin\AppData\Local\Temp\e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1696 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\system32\mspaint.exe"3⤵
- Deletes itself
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1720
-
-
-
C:\Users\Admin\AppData\Local\Temp\e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe"C:\Users\Admin\AppData\Local\Temp\e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1196 -
C:\Program Files\Internet Explorer\IEXPLORE.EXE"C:\Program Files\Internet Explorer\IEXPLORE.EXE"4⤵
- Modifies Internet Explorer settings
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:992 -
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:992 CREDAT:275457 /prefetch:25⤵
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1092
-
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
608B
MD5c6bad4e47d2e232a31c9e9a16f6289bb
SHA1d264a91b96f43206cb1a924165b6b5a69e60e5c7
SHA2566cfc42bce8f06690ff1afcdcad3a6cda2afa8cd69fccc277a5c9e644e0379a00
SHA512efcf21ac3925057aba84db6a983cab02173510afdd5e44799c764279a874f832cf74173bc8559ea141d2b4102804a1020da7ede62719c01ad66f8660f6fd9669