Analysis
-
max time kernel
149s -
max time network
136s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
07/11/2022, 13:03
Static task
static1
Behavioral task
behavioral1
Sample
5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe
Resource
win10v2004-20220812-en
General
-
Target
5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe
-
Size
612KB
-
MD5
0d42a14f0381d2c190fd55765285ea4d
-
SHA1
9ee8cf590a2f7b1cd8d6ee472aa673d52afcf04c
-
SHA256
5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a
-
SHA512
f9608ac10b9a9c4c67ec4cb47c4afbb951f3f3c2e9fc814950a30e01bbd12ab0552c8c43405bb82137f56cae919590f163c1eef713ecd2eaf3d4f6bafeb3f3a7
-
SSDEEP
12288:rJ72o+xixStQ6nXiINpopakmtCiiFgvrv3K:X+xix+Q6nXiIUyFvrv3K
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\utlio = "C:\\Windows\\SysWOW64\\fdBth4.exe" 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe -
Executes dropped EXE 1 IoCs
pid Process 580 fdBth4.exe -
resource yara_rule behavioral1/memory/1896-55-0x00000000004A0000-0x0000000000546000-memory.dmp upx behavioral1/memory/1896-58-0x00000000004A0000-0x0000000000546000-memory.dmp upx behavioral1/memory/1896-59-0x00000000004A0000-0x0000000000546000-memory.dmp upx -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe -
Deletes itself 1 IoCs
pid Process 1700 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\fdBth4.exe 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe File opened for modification C:\Windows\SysWOW64\fdBth4.exe 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe 580 fdBth4.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe Token: SeDebugPrivilege 580 fdBth4.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1896 wrote to memory of 580 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe 27 PID 1896 wrote to memory of 580 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe 27 PID 1896 wrote to memory of 580 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe 27 PID 1896 wrote to memory of 580 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe 27 PID 1896 wrote to memory of 1700 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe 29 PID 1896 wrote to memory of 1700 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe 29 PID 1896 wrote to memory of 1700 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe 29 PID 1896 wrote to memory of 1700 1896 5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe"C:\Users\Admin\AppData\Local\Temp\5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe"1⤵
- Adds policy Run key to start application
- Checks BIOS information in registry
- Loads dropped DLL
- Checks whether UAC is enabled
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\fdBth4.exeC:\Windows\SysWOW64\fdBth4.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:580
-
-
C:\Windows\SysWOW64\cmd.exe/c C:\Users\Admin\AppData\Local\Temp\~unins4095.bat "C:\Users\Admin\AppData\Local\Temp\5433d7c1dc507dd98fd0ef8811b08fdef4220a728f141331a039f31b2058a34a.exe"2⤵
- Deletes itself
PID:1700
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
49B
MD59e0a2f5ab30517809b95a1ff1dd98c53
SHA15c1eefdf10e67d1e9216e2e3f5e92352d583c9ce
SHA25697ac9fee75a1f7b63b3115e9c4fb9dda80b1caba26d2fb51325670dee261fe32
SHA512e959cc1fd48fb1cccf135a697924c775a3812bab211fc7f9b00c5a9d617261d84c5d6f7cb548774c1e8f46811b06ca39c5603d0e10cbcb7b805f9abbe49b9b42
-
Filesize
170KB
MD5b637001a19eade129b0c685fc8470721
SHA1201b3c3ce85e10ab229465baf241bd810d68ca18
SHA256631fc8bb18f6fb0317fd8d79e664f63507cf8c39de6615dd96da6e2e06b24da4
SHA5128f1bc10895c0fc375425468d5ed068b238ac2a8112c9e8995445f6e1e74b4633b3e206339098fe8f0fd55eeb5ebec5bf686bf27dbf18eaa52a37aeae3537b8e2
-
Filesize
170KB
MD5b637001a19eade129b0c685fc8470721
SHA1201b3c3ce85e10ab229465baf241bd810d68ca18
SHA256631fc8bb18f6fb0317fd8d79e664f63507cf8c39de6615dd96da6e2e06b24da4
SHA5128f1bc10895c0fc375425468d5ed068b238ac2a8112c9e8995445f6e1e74b4633b3e206339098fe8f0fd55eeb5ebec5bf686bf27dbf18eaa52a37aeae3537b8e2
-
Filesize
170KB
MD5b637001a19eade129b0c685fc8470721
SHA1201b3c3ce85e10ab229465baf241bd810d68ca18
SHA256631fc8bb18f6fb0317fd8d79e664f63507cf8c39de6615dd96da6e2e06b24da4
SHA5128f1bc10895c0fc375425468d5ed068b238ac2a8112c9e8995445f6e1e74b4633b3e206339098fe8f0fd55eeb5ebec5bf686bf27dbf18eaa52a37aeae3537b8e2