Analysis
-
max time kernel
152s -
max time network
189s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 23:52
Static task
static1
Behavioral task
behavioral1
Sample
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe
Resource
win10v2004-20221111-en
General
-
Target
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe
-
Size
180KB
-
MD5
597667895aedbcaa4c6f77b90e9e2994
-
SHA1
681232c7a6f08da5652c775b77f739a8273a96b3
-
SHA256
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db
-
SHA512
6464a0d666a21fdef70bb42cc5d101301353a76c01ad0177dfb0af4f852d706196eda0a5569ad7810070a8a573da0a0cac357e5320b5c232ca18b8519eea7cd0
-
SSDEEP
3072:nyEhVg7DPPiyJajXzsyxwiFdZz2iJHlSRcMgfBRbL:yEhS7DFa8P6dxpl4I
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1120-57-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1120-59-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1120-60-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1120-62-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1120-63-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1120-68-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1120-77-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1820-78-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1144-84-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1144-85-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1144-86-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1120-100-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral1/memory/1820-242-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exemspaint.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Dflqlt = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Dflqlt.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exemspaint.exedescription ioc process File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\S: svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exedescription pid process target process PID 872 set thread context of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 1120 set thread context of 964 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exesvchost.exe87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exepid process 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 1820 svchost.exe 964 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exepid process 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exesvchost.execalc.exemspaint.exedescription pid process Token: 33 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe Token: SeIncBasePriorityPrivilege 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe Token: SeDebugPrivilege 964 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe Token: SeDebugPrivilege 1820 svchost.exe Token: SeDebugPrivilege 332 calc.exe Token: SeDebugPrivilege 1144 mspaint.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exesvchost.exe87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exedescription pid process target process PID 872 wrote to memory of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 872 wrote to memory of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 872 wrote to memory of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 872 wrote to memory of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 872 wrote to memory of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 872 wrote to memory of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 872 wrote to memory of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 872 wrote to memory of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 872 wrote to memory of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 872 wrote to memory of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 872 wrote to memory of 1120 872 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 1120 wrote to memory of 1820 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe svchost.exe PID 1120 wrote to memory of 1820 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe svchost.exe PID 1120 wrote to memory of 1820 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe svchost.exe PID 1120 wrote to memory of 1820 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe svchost.exe PID 1120 wrote to memory of 332 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe calc.exe PID 1120 wrote to memory of 332 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe calc.exe PID 1120 wrote to memory of 332 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe calc.exe PID 1120 wrote to memory of 332 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe calc.exe PID 1120 wrote to memory of 332 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe calc.exe PID 1120 wrote to memory of 332 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe calc.exe PID 1120 wrote to memory of 1820 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe svchost.exe PID 1820 wrote to memory of 1144 1820 svchost.exe mspaint.exe PID 1820 wrote to memory of 1144 1820 svchost.exe mspaint.exe PID 1820 wrote to memory of 1144 1820 svchost.exe mspaint.exe PID 1820 wrote to memory of 1144 1820 svchost.exe mspaint.exe PID 1820 wrote to memory of 1144 1820 svchost.exe mspaint.exe PID 1120 wrote to memory of 964 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 1120 wrote to memory of 964 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 1120 wrote to memory of 964 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 1120 wrote to memory of 964 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 1120 wrote to memory of 964 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 1120 wrote to memory of 964 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 1120 wrote to memory of 964 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 1120 wrote to memory of 964 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 1120 wrote to memory of 964 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 1120 wrote to memory of 964 1120 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe PID 964 wrote to memory of 1820 964 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe svchost.exe PID 964 wrote to memory of 1820 964 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe svchost.exe PID 964 wrote to memory of 332 964 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe calc.exe PID 964 wrote to memory of 332 964 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe calc.exe PID 964 wrote to memory of 1144 964 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe mspaint.exe PID 964 wrote to memory of 1144 964 87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe"C:\Users\Admin\AppData\Local\Temp\87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe"C:\Users\Admin\AppData\Local\Temp\87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\SysWOW64\mspaint.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe"C:\Users\Admin\AppData\Local\Temp\87ef7737e731697628480a80fcd00dfecadf68a2a7f40a9ebf7f00908d1fd6db.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/332-70-0x00000000000C0000-0x00000000000C2000-memory.dmpFilesize
8KB
-
memory/332-350-0x00000000001A8000-0x00000000001AA000-memory.dmpFilesize
8KB
-
memory/332-340-0x0000000000170000-0x00000000001BE000-memory.dmpFilesize
312KB
-
memory/332-149-0x0000000000170000-0x00000000001BE000-memory.dmpFilesize
312KB
-
memory/332-126-0x0000000000170000-0x00000000001BE000-memory.dmpFilesize
312KB
-
memory/332-120-0x0000000000170000-0x00000000001BE000-memory.dmpFilesize
312KB
-
memory/332-115-0x0000000000170000-0x00000000001BE000-memory.dmpFilesize
312KB
-
memory/332-104-0x00000000000C0000-0x00000000000C2000-memory.dmpFilesize
8KB
-
memory/332-73-0x0000000000000000-mapping.dmp
-
memory/872-65-0x0000000000230000-0x0000000000244000-memory.dmpFilesize
80KB
-
memory/964-128-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/964-88-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/964-103-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/964-102-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/964-98-0x0000000000410910-mapping.dmp
-
memory/964-97-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/964-95-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/964-93-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/964-91-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/964-89-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1120-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1120-68-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1120-64-0x0000000000404BF0-mapping.dmp
-
memory/1120-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1120-54-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1120-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1120-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1120-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1120-77-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1120-100-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1120-67-0x0000000075F81000-0x0000000075F83000-memory.dmpFilesize
8KB
-
memory/1120-55-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1144-87-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1144-129-0x00000000008A0000-0x00000000008EE000-memory.dmpFilesize
312KB
-
memory/1144-341-0x00000000008A0000-0x00000000008EE000-memory.dmpFilesize
312KB
-
memory/1144-86-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1144-153-0x00000000008A0000-0x00000000008EE000-memory.dmpFilesize
312KB
-
memory/1144-122-0x00000000008A0000-0x00000000008EE000-memory.dmpFilesize
312KB
-
memory/1144-85-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1144-81-0x0000000000000000-mapping.dmp
-
memory/1144-84-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1144-105-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1144-83-0x0000000000281000-0x0000000000283000-memory.dmpFilesize
8KB
-
memory/1820-127-0x0000000000380000-0x00000000003CE000-memory.dmpFilesize
312KB
-
memory/1820-145-0x0000000000380000-0x00000000003CE000-memory.dmpFilesize
312KB
-
memory/1820-119-0x0000000000380000-0x00000000003CE000-memory.dmpFilesize
312KB
-
memory/1820-113-0x0000000000380000-0x00000000003CE000-memory.dmpFilesize
312KB
-
memory/1820-242-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1820-339-0x0000000000380000-0x00000000003CE000-memory.dmpFilesize
312KB
-
memory/1820-78-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1820-110-0x0000000000380000-0x00000000003CE000-memory.dmpFilesize
312KB
-
memory/1820-74-0x0000000000000000-mapping.dmp