Analysis
-
max time kernel
161s -
max time network
170s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
22-11-2022 19:00
Static task
static1
Behavioral task
behavioral1
Sample
3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe
Resource
win10v2004-20221111-en
General
-
Target
3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe
-
Size
209KB
-
MD5
89c736dbc7d0ec3c9002af1e21c78c59
-
SHA1
5ec8c000e53a5482871140e13f228a2de719bb0b
-
SHA256
3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2
-
SHA512
890c25e8a82b0751900a5032225bfad1a0ab8aaaa72876d8835e154151b7b00ca7e1da25ff58830b5a8b425df4c9d3598a50994f35d3cdd333627e5595bf8d44
-
SSDEEP
3072:lqthA9554iwyv02BMI2m9GbL7+nnI6wGCwSncmuo8XihThl:lShAJ132aGAI6wG3Scmuo8XiRH
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/3492-136-0x0000000000400000-0x000000000042B000-memory.dmp cryptone behavioral2/memory/776-142-0x00000000005C0000-0x00000000005EB000-memory.dmp cryptone behavioral2/memory/776-143-0x00000000005C0000-0x00000000005EB000-memory.dmp cryptone behavioral2/memory/776-144-0x00000000005C0000-0x00000000005EB000-memory.dmp cryptone behavioral2/memory/3492-149-0x0000000000400000-0x000000000042B000-memory.dmp cryptone behavioral2/memory/1444-152-0x0000000000E70000-0x0000000000E9B000-memory.dmp cryptone -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
svchost.exemspaint.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\Software\Microsoft\Windows\CurrentVersion\Run mspaint.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Yttitg = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Yttitg.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exemspaint.exedescription ioc process File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\J: svchost.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exedescription pid process target process PID 672 set thread context of 2884 672 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2884 set thread context of 3492 2884 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 3492 set thread context of 2328 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe -
Drops file in Program Files directory 1 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Program Files\Common Files\CreativeAudio svchost.exe -
Suspicious behavior: EnumeratesProcesses 5 IoCs
Processes:
svchost.exe3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exepid process 1444 svchost.exe 1444 svchost.exe 2328 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 2328 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 2328 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.execalc.exesvchost.exemspaint.exedescription pid process Token: SeDebugPrivilege 2328 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe Token: SeDebugPrivilege 1060 calc.exe Token: SeDebugPrivilege 1444 svchost.exe Token: SeDebugPrivilege 776 mspaint.exe -
Suspicious use of WriteProcessMemory 46 IoCs
Processes:
3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exesvchost.exe3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exedescription pid process target process PID 672 wrote to memory of 2884 672 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 672 wrote to memory of 2884 672 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 672 wrote to memory of 2884 672 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 672 wrote to memory of 2884 672 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 672 wrote to memory of 2884 672 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 672 wrote to memory of 2884 672 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 672 wrote to memory of 2884 672 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2884 wrote to memory of 3492 2884 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2884 wrote to memory of 3492 2884 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2884 wrote to memory of 3492 2884 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2884 wrote to memory of 3492 2884 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2884 wrote to memory of 3492 2884 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2884 wrote to memory of 3492 2884 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2884 wrote to memory of 3492 2884 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2884 wrote to memory of 3492 2884 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2884 wrote to memory of 3492 2884 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2884 wrote to memory of 3492 2884 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 3492 wrote to memory of 1444 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe svchost.exe PID 3492 wrote to memory of 1444 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe svchost.exe PID 3492 wrote to memory of 1444 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe svchost.exe PID 3492 wrote to memory of 1444 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe svchost.exe PID 3492 wrote to memory of 1444 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe svchost.exe PID 3492 wrote to memory of 1060 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe calc.exe PID 3492 wrote to memory of 1060 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe calc.exe PID 3492 wrote to memory of 1060 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe calc.exe PID 3492 wrote to memory of 1060 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe calc.exe PID 3492 wrote to memory of 1060 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe calc.exe PID 1444 wrote to memory of 776 1444 svchost.exe mspaint.exe PID 1444 wrote to memory of 776 1444 svchost.exe mspaint.exe PID 1444 wrote to memory of 776 1444 svchost.exe mspaint.exe PID 1444 wrote to memory of 776 1444 svchost.exe mspaint.exe PID 3492 wrote to memory of 2328 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 3492 wrote to memory of 2328 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 3492 wrote to memory of 2328 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 3492 wrote to memory of 2328 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 3492 wrote to memory of 2328 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 3492 wrote to memory of 2328 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 3492 wrote to memory of 2328 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 3492 wrote to memory of 2328 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 3492 wrote to memory of 2328 3492 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe PID 2328 wrote to memory of 1060 2328 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe calc.exe PID 2328 wrote to memory of 1060 2328 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe calc.exe PID 2328 wrote to memory of 1444 2328 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe svchost.exe PID 2328 wrote to memory of 1444 2328 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe svchost.exe PID 2328 wrote to memory of 776 2328 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe mspaint.exe PID 2328 wrote to memory of 776 2328 3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe"C:\Users\Admin\AppData\Local\Temp\3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe"C:\Users\Admin\AppData\Local\Temp\3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe"C:\Users\Admin\AppData\Local\Temp\3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe"3⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\SysWOW64\mspaint.exe"5⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe"C:\Users\Admin\AppData\Local\Temp\3c89b44aefb48d3458ec2de81a1f00564ef40e8ce5015b3e94cd320bcd9a9de2.exe"4⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/776-142-0x00000000005C0000-0x00000000005EB000-memory.dmpFilesize
172KB
-
memory/776-158-0x0000000000810000-0x000000000085E000-memory.dmpFilesize
312KB
-
memory/776-157-0x0000000000810000-0x000000000085E000-memory.dmpFilesize
312KB
-
memory/776-153-0x00000000005C0000-0x00000000005EB000-memory.dmpFilesize
172KB
-
memory/776-144-0x00000000005C0000-0x00000000005EB000-memory.dmpFilesize
172KB
-
memory/776-143-0x00000000005C0000-0x00000000005EB000-memory.dmpFilesize
172KB
-
memory/776-145-0x00000000005C0000-0x00000000005EB000-memory.dmpFilesize
172KB
-
memory/776-141-0x0000000000000000-mapping.dmp
-
memory/1060-140-0x0000000000000000-mapping.dmp
-
memory/1060-155-0x0000000002B30000-0x0000000002B7E000-memory.dmpFilesize
312KB
-
memory/1444-152-0x0000000000E70000-0x0000000000E9B000-memory.dmpFilesize
172KB
-
memory/1444-139-0x0000000000000000-mapping.dmp
-
memory/1444-156-0x0000000000EC0000-0x0000000000F0E000-memory.dmpFilesize
312KB
-
memory/2328-150-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2328-151-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2328-147-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2328-154-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2328-146-0x0000000000000000-mapping.dmp
-
memory/2884-132-0x0000000000000000-mapping.dmp
-
memory/2884-138-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/2884-133-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/3492-149-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/3492-136-0x0000000000400000-0x000000000042B000-memory.dmpFilesize
172KB
-
memory/3492-135-0x0000000000000000-mapping.dmp