Analysis
-
max time kernel
42s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 09:07
Static task
static1
Behavioral task
behavioral1
Sample
9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe
Resource
win10v2004-20220901-en
General
-
Target
9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe
-
Size
159KB
-
MD5
2b98fe0a860c304865d176a00a2a68ca
-
SHA1
b720520cd86e59a7d11fb820f2bc7045c0d78d6a
-
SHA256
9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04
-
SHA512
8005704214c9eb77ae631d9afc00a6584b381be8ac3b9dfb59581086aeee5d441830e03f544300416b06d8cf1d4ba930a86bb1adf83cf26b70a59e641c37579f
-
SSDEEP
3072:UXCiLk7ndEFIp8d94jVS1CzyyUQG0m7nEHrn2brK6scBey7yTF0Lm9:U4YI09oS1C+ygn21ew
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-44353245\\4s53274.exe" 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\s4d424576 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-44353245\\4s53274.exe" 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exedescription ioc process File created C:\RECYCLER\S-1-5-21-0243556031-888888379-781863308-44353245\Desktop.ini 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe -
Modifies WinLogon 2 TTPs 1 IoCs
Processes:
9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781863308-44353245\\4s53274.exe" 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exedescription pid process target process PID 1964 set thread context of 1340 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exepid process 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 1340 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exedescription pid process target process PID 1964 wrote to memory of 1340 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe PID 1964 wrote to memory of 1340 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe PID 1964 wrote to memory of 1340 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe PID 1964 wrote to memory of 1340 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe PID 1964 wrote to memory of 1340 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe PID 1964 wrote to memory of 1340 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe PID 1964 wrote to memory of 1340 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe PID 1964 wrote to memory of 1340 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe PID 1964 wrote to memory of 1340 1964 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe PID 1340 wrote to memory of 1208 1340 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe Explorer.EXE PID 1340 wrote to memory of 1208 1340 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe Explorer.EXE PID 1340 wrote to memory of 1208 1340 9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe"C:\Users\Admin\AppData\Local\Temp\9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe"C:\Users\Admin\AppData\Local\Temp\9d7f699de44b8dcd5d7a98e0117c067154ffd0ee60fe3314ea769074f81a9a04.exe"3⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops desktop.ini file(s)
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1340-54-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1340-55-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1340-57-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1340-58-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1340-60-0x0000000000401920-mapping.dmp
-
memory/1340-59-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1340-62-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB