Analysis
-
max time kernel
140s -
max time network
152s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
22-11-2022 18:13
Static task
static1
Behavioral task
behavioral1
Sample
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe
Resource
win10v2004-20221111-en
General
-
Target
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe
-
Size
259KB
-
MD5
494354224e43d50c26209cbeb7096e75
-
SHA1
7cc6ad32caaed9df42f05ad01b8c15eacbb31f61
-
SHA256
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b
-
SHA512
56ba88d6e1a41d26d0f6d4ce865b8bd6c6e747c8d954234c576e78e32924796f88f6625d84d29b3dd89d7bb898947ccc53f49aa9eb243efb73e84993084328f2
-
SSDEEP
6144:pXgAUZ0z0l4E/43IB2i8HsI2MM2zxEftvk:pXgAg0zjE/4YBWHsIVktM
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1068-60-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1068-58-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1068-61-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1068-63-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1068-64-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1068-74-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/620-84-0x00000000000C0000-0x00000000000E9000-memory.dmp cryptone behavioral1/memory/620-85-0x00000000000C0000-0x00000000000E9000-memory.dmp cryptone behavioral1/memory/620-86-0x00000000000C0000-0x00000000000E9000-memory.dmp cryptone behavioral1/memory/948-88-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1068-102-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/948-257-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exemspaint.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Nbyyyl = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Nbyyyl.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exemspaint.exedescription ioc process File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\M: svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exeae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exedescription pid process target process PID 576 set thread context of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1068 set thread context of 664 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exesvchost.exeae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exepid process 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe 948 svchost.exe 664 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exepid process 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.execalc.exesvchost.exemspaint.exedescription pid process Token: SeDebugPrivilege 664 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe Token: SeDebugPrivilege 1616 calc.exe Token: SeDebugPrivilege 948 svchost.exe Token: SeDebugPrivilege 620 mspaint.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exeae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exesvchost.exeae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exedescription pid process target process PID 576 wrote to memory of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 576 wrote to memory of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 576 wrote to memory of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 576 wrote to memory of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 576 wrote to memory of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 576 wrote to memory of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 576 wrote to memory of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 576 wrote to memory of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 576 wrote to memory of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 576 wrote to memory of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 576 wrote to memory of 1068 576 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1068 wrote to memory of 1616 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 1068 wrote to memory of 1616 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 1068 wrote to memory of 1616 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 1068 wrote to memory of 1616 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 1068 wrote to memory of 1616 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 1068 wrote to memory of 1616 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 1068 wrote to memory of 948 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 1068 wrote to memory of 948 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 1068 wrote to memory of 948 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 1068 wrote to memory of 948 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 1068 wrote to memory of 948 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 948 wrote to memory of 620 948 svchost.exe mspaint.exe PID 948 wrote to memory of 620 948 svchost.exe mspaint.exe PID 948 wrote to memory of 620 948 svchost.exe mspaint.exe PID 948 wrote to memory of 620 948 svchost.exe mspaint.exe PID 948 wrote to memory of 620 948 svchost.exe mspaint.exe PID 1068 wrote to memory of 664 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1068 wrote to memory of 664 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1068 wrote to memory of 664 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1068 wrote to memory of 664 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1068 wrote to memory of 664 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1068 wrote to memory of 664 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1068 wrote to memory of 664 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1068 wrote to memory of 664 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1068 wrote to memory of 664 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1068 wrote to memory of 664 1068 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 664 wrote to memory of 948 664 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 664 wrote to memory of 948 664 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 664 wrote to memory of 1616 664 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 664 wrote to memory of 1616 664 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 664 wrote to memory of 620 664 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe mspaint.exe PID 664 wrote to memory of 620 664 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\SysWOW64\mspaint.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/576-54-0x0000000075911000-0x0000000075913000-memory.dmpFilesize
8KB
-
memory/576-68-0x00000000001C0000-0x00000000001DA000-memory.dmpFilesize
104KB
-
memory/620-81-0x0000000000000000-mapping.dmp
-
memory/620-83-0x0000000000491000-0x0000000000493000-memory.dmpFilesize
8KB
-
memory/620-89-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/620-177-0x00000000001B0000-0x00000000001FE000-memory.dmpFilesize
312KB
-
memory/620-86-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/620-87-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/620-85-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/620-349-0x00000000001B0000-0x00000000001FE000-memory.dmpFilesize
312KB
-
memory/620-84-0x00000000000C0000-0x00000000000E9000-memory.dmpFilesize
164KB
-
memory/620-121-0x00000000001B0000-0x00000000001FE000-memory.dmpFilesize
312KB
-
memory/664-97-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/664-93-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/664-91-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/664-90-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/664-95-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/664-99-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/664-100-0x0000000000410910-mapping.dmp
-
memory/664-104-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/664-105-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/664-127-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/948-119-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/948-113-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/948-77-0x0000000000000000-mapping.dmp
-
memory/948-347-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/948-257-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/948-169-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/948-88-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/948-125-0x0000000000280000-0x00000000002CE000-memory.dmpFilesize
312KB
-
memory/1068-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1068-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1068-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1068-55-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1068-102-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1068-74-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1068-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1068-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1068-65-0x00000000004041E0-mapping.dmp
-
memory/1068-64-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1616-122-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/1616-69-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/1616-71-0x0000000000000000-mapping.dmp
-
memory/1616-173-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/1616-128-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/1616-73-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/1616-115-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/1616-348-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/1616-111-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB