Analysis

  • max time kernel
    39s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07-11-2022 12:24

General

  • Target

    71c7c7abb28d61525629eae7155f7e6f80dd8ac5890bbffcda442fb7b9b914d0.exe

  • Size

    40KB

  • MD5

    0df526fb078ea80877c53ca07981ead0

  • SHA1

    c1d6db91c7d69ad98949f7c25c13a9a84559cce1

  • SHA256

    71c7c7abb28d61525629eae7155f7e6f80dd8ac5890bbffcda442fb7b9b914d0

  • SHA512

    a476b94d72eb257f6313e607ca908d6608b6c2e5a30b1d4fff17bd3437a52b3393c06a0017501815db3dcdb3176b220ce81245d9587c0bca0a294c27696505e8

  • SSDEEP

    768:/4q31nOB9pDFxP+4bfWdGn36VMHnKMGK0c1snx:/4o9qDpbf0sq6HMnx

Malware Config

Signatures

  • Possible privilege escalation attempt 2 IoCs
  • Modifies file permissions 1 TTPs 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Drops file in System32 directory 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
  • Modifies Internet Explorer start page 1 TTPs 2 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 12 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\71c7c7abb28d61525629eae7155f7e6f80dd8ac5890bbffcda442fb7b9b914d0.exe
    "C:\Users\Admin\AppData\Local\Temp\71c7c7abb28d61525629eae7155f7e6f80dd8ac5890bbffcda442fb7b9b914d0.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in System32 directory
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1476
    • C:\Windows\SysWOW64\takeown.exe
      C:\Windows\system32\takeown.exe /f "C:\Windows\system32\exds.exe"
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:1736
    • C:\Windows\SysWOW64\icacls.exe
      C:\Windows\system32\icacls.exe "C:\Windows\system32\exds.exe" /grant Users:F
      2⤵
      • Possible privilege escalation attempt
      • Modifies file permissions
      PID:1984
    • C:\Windows\SysWOW64\regini.exe
      C:\Windows\system32\\regini.exe "C:\Users\Admin\AppData\Local\Temp\uucRftC.ini"
      2⤵
      • Modifies Internet Explorer settings
      • Modifies Internet Explorer start page
      PID:1328

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\uucRftC.ini

    Filesize

    633B

    MD5

    307edf4a3258717302e3d2ba7865ec69

    SHA1

    faa9b10078b3ee200bea0cb2645157843a8e4908

    SHA256

    bc4f3fa5dc6d89b482f4f09363cf82b6c6500b853b4d5fe3c589c4dc6601bf9a

    SHA512

    dfaa7e643e0c477701cce3de1aba8d506a1063d72547d760bcc76c274dd9069ad6529dfe341ff4202a8d50aabaa712db4c76928cc455fefb3f1601cf85558715

  • C:\Windows\SysWOW64\exds.exe

    Filesize

    40KB

    MD5

    0df526fb078ea80877c53ca07981ead0

    SHA1

    c1d6db91c7d69ad98949f7c25c13a9a84559cce1

    SHA256

    71c7c7abb28d61525629eae7155f7e6f80dd8ac5890bbffcda442fb7b9b914d0

    SHA512

    a476b94d72eb257f6313e607ca908d6608b6c2e5a30b1d4fff17bd3437a52b3393c06a0017501815db3dcdb3176b220ce81245d9587c0bca0a294c27696505e8

  • memory/1328-59-0x0000000000000000-mapping.dmp

  • memory/1736-56-0x0000000000000000-mapping.dmp

  • memory/1984-57-0x0000000000000000-mapping.dmp