Analysis
-
max time kernel
135s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
19/11/2022, 01:31
Static task
static1
Behavioral task
behavioral1
Sample
6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe
Resource
win7-20220812-en
General
-
Target
6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe
-
Size
267KB
-
MD5
099d3e1c8e153545bca1dee9799f605c
-
SHA1
8ab7103020dd543860cb3ab44cd7a0265d6a99d8
-
SHA256
6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0
-
SHA512
b061367a5d626009a1d14e4df202e906ff80d5f3e38eea8c392888887cd101c6c22a5621933489edb1bdf96e80233931bb5421363b7ddf23552e88d1a1463ff6
-
SSDEEP
6144:grOEksOCvZdbNrEPDjH/1GyjG1nkdR7YDxk3i2k/Fdn:grU2HNrEPfNGkikdexky2k/Hn
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1908 CC74.tmp -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
resource yara_rule behavioral1/memory/2012-56-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/540-62-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2012-63-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1740-67-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Loads dropped DLL 2 IoCs
pid Process 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\2BD.exe = "C:\\Program Files (x86)\\LP\\3C7F\\2BD.exe" 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\3C7F\2BD.exe 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe File opened for modification C:\Program Files (x86)\LP\3C7F\CC74.tmp 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe File opened for modification C:\Program Files (x86)\LP\3C7F\2BD.exe 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1656 explorer.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeRestorePrivilege 680 msiexec.exe Token: SeTakeOwnershipPrivilege 680 msiexec.exe Token: SeSecurityPrivilege 680 msiexec.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe Token: 33 324 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 324 AUDIODG.EXE Token: 33 324 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 324 AUDIODG.EXE Token: SeShutdownPrivilege 1656 explorer.exe Token: SeShutdownPrivilege 1656 explorer.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe 1656 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2012 wrote to memory of 540 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 28 PID 2012 wrote to memory of 540 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 28 PID 2012 wrote to memory of 540 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 28 PID 2012 wrote to memory of 540 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 28 PID 2012 wrote to memory of 1740 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 30 PID 2012 wrote to memory of 1740 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 30 PID 2012 wrote to memory of 1740 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 30 PID 2012 wrote to memory of 1740 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 30 PID 2012 wrote to memory of 1908 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 32 PID 2012 wrote to memory of 1908 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 32 PID 2012 wrote to memory of 1908 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 32 PID 2012 wrote to memory of 1908 2012 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe 32 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" 6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe"C:\Users\Admin\AppData\Local\Temp\6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2012 -
C:\Users\Admin\AppData\Local\Temp\6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exeC:\Users\Admin\AppData\Local\Temp\6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe startC:\Users\Admin\AppData\Roaming\F331F\72B3C.exe%C:\Users\Admin\AppData\Roaming\F331F2⤵PID:540
-
-
C:\Users\Admin\AppData\Local\Temp\6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exeC:\Users\Admin\AppData\Local\Temp\6d63be6a38abecf0ba3aa7d63d560e19173d0b75339d5b6e6161095d76551ec0.exe startC:\Program Files (x86)\1F919\lvvm.exe%C:\Program Files (x86)\1F9192⤵PID:1740
-
-
C:\Program Files (x86)\LP\3C7F\CC74.tmp"C:\Program Files (x86)\LP\3C7F\CC74.tmp"2⤵
- Executes dropped EXE
PID:1908
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:680
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1656
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x58c1⤵
- Suspicious use of AdjustPrivilegeToken
PID:324
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
96KB
MD5d2107853a586cd3de22453b0f993e083
SHA1d852e2de5a3038aa0dfd5a580d4a8933dfbcee64
SHA2566d3d8a003ed2309d61e52ed9aa7bbd02b2b9f88bda1d16fa92eaf322546086d3
SHA512fb9a6bad9ad8c4f11713ece4f82457d44cbd79648893cc913b4b57cd03a891f4b047272c0343451212d639af2a62c4eb1b8240987668c91ff15a283c8b7ae661
-
Filesize
96KB
MD5d2107853a586cd3de22453b0f993e083
SHA1d852e2de5a3038aa0dfd5a580d4a8933dfbcee64
SHA2566d3d8a003ed2309d61e52ed9aa7bbd02b2b9f88bda1d16fa92eaf322546086d3
SHA512fb9a6bad9ad8c4f11713ece4f82457d44cbd79648893cc913b4b57cd03a891f4b047272c0343451212d639af2a62c4eb1b8240987668c91ff15a283c8b7ae661
-
Filesize
96KB
MD5d2107853a586cd3de22453b0f993e083
SHA1d852e2de5a3038aa0dfd5a580d4a8933dfbcee64
SHA2566d3d8a003ed2309d61e52ed9aa7bbd02b2b9f88bda1d16fa92eaf322546086d3
SHA512fb9a6bad9ad8c4f11713ece4f82457d44cbd79648893cc913b4b57cd03a891f4b047272c0343451212d639af2a62c4eb1b8240987668c91ff15a283c8b7ae661