Analysis
-
max time kernel
155s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 18:13
Static task
static1
Behavioral task
behavioral1
Sample
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe
Resource
win10v2004-20221111-en
General
-
Target
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe
-
Size
259KB
-
MD5
494354224e43d50c26209cbeb7096e75
-
SHA1
7cc6ad32caaed9df42f05ad01b8c15eacbb31f61
-
SHA256
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b
-
SHA512
56ba88d6e1a41d26d0f6d4ce865b8bd6c6e747c8d954234c576e78e32924796f88f6625d84d29b3dd89d7bb898947ccc53f49aa9eb243efb73e84993084328f2
-
SSDEEP
6144:pXgAUZ0z0l4E/43IB2i8HsI2MM2zxEftvk:pXgAg0zjE/4YBWHsIVktM
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4388-133-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral2/memory/1476-139-0x00000000010C0000-0x00000000010E9000-memory.dmp cryptone behavioral2/memory/1476-141-0x00000000010C0000-0x00000000010E9000-memory.dmp cryptone behavioral2/memory/1476-140-0x00000000010C0000-0x00000000010E9000-memory.dmp cryptone behavioral2/memory/4388-147-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral2/memory/224-145-0x0000000000F60000-0x0000000000F89000-memory.dmp cryptone -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
mspaint.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Lbytye = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Lbytye.exe" mspaint.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exemspaint.exedescription ioc process File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\X: svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exeae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exedescription pid process target process PID 1620 set thread context of 4388 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 4388 set thread context of 3492 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exesvchost.exeae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exepid process 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe 224 svchost.exe 224 svchost.exe 3492 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe 3492 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe 3492 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exepid process 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exesvchost.execalc.exemspaint.exedescription pid process Token: SeDebugPrivilege 3492 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe Token: SeDebugPrivilege 224 svchost.exe Token: SeDebugPrivilege 1168 calc.exe Token: SeDebugPrivilege 1476 mspaint.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exeae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exesvchost.exeae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exedescription pid process target process PID 1620 wrote to memory of 4388 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1620 wrote to memory of 4388 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1620 wrote to memory of 4388 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1620 wrote to memory of 4388 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1620 wrote to memory of 4388 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1620 wrote to memory of 4388 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1620 wrote to memory of 4388 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1620 wrote to memory of 4388 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1620 wrote to memory of 4388 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 1620 wrote to memory of 4388 1620 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 4388 wrote to memory of 224 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 4388 wrote to memory of 224 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 4388 wrote to memory of 224 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 4388 wrote to memory of 224 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 4388 wrote to memory of 1168 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 4388 wrote to memory of 1168 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 4388 wrote to memory of 1168 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 4388 wrote to memory of 1168 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 4388 wrote to memory of 1168 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 224 wrote to memory of 1476 224 svchost.exe mspaint.exe PID 224 wrote to memory of 1476 224 svchost.exe mspaint.exe PID 224 wrote to memory of 1476 224 svchost.exe mspaint.exe PID 224 wrote to memory of 1476 224 svchost.exe mspaint.exe PID 4388 wrote to memory of 3492 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 4388 wrote to memory of 3492 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 4388 wrote to memory of 3492 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 4388 wrote to memory of 3492 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 4388 wrote to memory of 3492 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 4388 wrote to memory of 3492 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 4388 wrote to memory of 3492 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 4388 wrote to memory of 3492 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 4388 wrote to memory of 3492 4388 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe PID 3492 wrote to memory of 224 3492 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 3492 wrote to memory of 224 3492 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe svchost.exe PID 3492 wrote to memory of 1168 3492 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 3492 wrote to memory of 1168 3492 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe calc.exe PID 3492 wrote to memory of 1476 3492 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe mspaint.exe PID 3492 wrote to memory of 1476 3492 ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\SysWOW64\mspaint.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"C:\Users\Admin\AppData\Local\Temp\ae67f53eb1a31bd8e61c2405c6a1634418ce518c565184cd9c9fdcb56c496d0b.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/224-145-0x0000000000F60000-0x0000000000F89000-memory.dmpFilesize
164KB
-
memory/224-155-0x0000000003530000-0x000000000357E000-memory.dmpFilesize
312KB
-
memory/224-151-0x0000000003530000-0x000000000357E000-memory.dmpFilesize
312KB
-
memory/224-136-0x0000000000000000-mapping.dmp
-
memory/1168-152-0x0000000002140000-0x000000000218E000-memory.dmpFilesize
312KB
-
memory/1168-156-0x0000000002140000-0x000000000218E000-memory.dmpFilesize
312KB
-
memory/1168-137-0x0000000000000000-mapping.dmp
-
memory/1476-138-0x0000000000000000-mapping.dmp
-
memory/1476-139-0x00000000010C0000-0x00000000010E9000-memory.dmpFilesize
164KB
-
memory/1476-141-0x00000000010C0000-0x00000000010E9000-memory.dmpFilesize
164KB
-
memory/1476-142-0x00000000010C0000-0x00000000010E9000-memory.dmpFilesize
164KB
-
memory/1476-140-0x00000000010C0000-0x00000000010E9000-memory.dmpFilesize
164KB
-
memory/1476-157-0x0000000001100000-0x000000000114E000-memory.dmpFilesize
312KB
-
memory/1476-153-0x0000000001100000-0x000000000114E000-memory.dmpFilesize
312KB
-
memory/1476-148-0x00000000010C0000-0x00000000010E9000-memory.dmpFilesize
164KB
-
memory/1620-135-0x0000000000530000-0x000000000054A000-memory.dmpFilesize
104KB
-
memory/3492-150-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/3492-149-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/3492-144-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/3492-154-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/3492-143-0x0000000000000000-mapping.dmp
-
memory/4388-132-0x0000000000000000-mapping.dmp
-
memory/4388-133-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4388-147-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB