Analysis
-
max time kernel
151s -
max time network
62s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 12:36
Static task
static1
Behavioral task
behavioral1
Sample
fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe
Resource
win10v2004-20220901-en
General
-
Target
fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe
-
Size
453KB
-
MD5
c34d23438f8ce0b7a784213bbcd4d5d7
-
SHA1
0765a0299677199ea519545c8d48657dbe2ae4c0
-
SHA256
fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555
-
SHA512
9c8d5f1848bf1b5e815c007e28b530144c916a6e3e3657ced213ec33ef8383d77db6367258b0d74ef5d6ebccfc8f7c507c3ec56f02db564daeee345635552165
-
SSDEEP
6144:5zoTXwL+qUxYYOKJ1VzoEYrM2zxa03DrGsPPuRfiFv7VJG3/JnDHGcM:Y6yxY3KdoEyFWsPWRKFvhJG3/9D
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\NBKJBVKJBK = "C:\\Users\\Admin\\AppData\\Roaming\\NBKJBVKJYT\\Svchost.exe" fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exedescription pid process target process PID 872 set thread context of 908 872 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exepid process 908 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exefd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exedescription pid process Token: SeDebugPrivilege 872 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe Token: SeDebugPrivilege 908 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exepid process 908 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exedescription pid process target process PID 872 wrote to memory of 908 872 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe PID 872 wrote to memory of 908 872 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe PID 872 wrote to memory of 908 872 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe PID 872 wrote to memory of 908 872 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe PID 872 wrote to memory of 908 872 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe PID 872 wrote to memory of 908 872 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe PID 872 wrote to memory of 908 872 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe PID 872 wrote to memory of 908 872 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe PID 872 wrote to memory of 908 872 fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe"C:\Users\Admin\AppData\Local\Temp\fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:872 -
C:\Users\Admin\AppData\Local\Temp\fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe"C:\Users\Admin\AppData\Local\Temp\fd7f3b1b7d1fc00208435faac2bc1b4601a46975af97a647f86e5888a75f6555.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:908
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/872-54-0x0000000076191000-0x0000000076193000-memory.dmpFilesize
8KB
-
memory/872-55-0x0000000074C90000-0x000000007523B000-memory.dmpFilesize
5.7MB
-
memory/872-56-0x0000000074C90000-0x000000007523B000-memory.dmpFilesize
5.7MB
-
memory/872-69-0x0000000074C90000-0x000000007523B000-memory.dmpFilesize
5.7MB
-
memory/908-61-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/908-60-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/908-58-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/908-63-0x000000000044685E-mapping.dmp
-
memory/908-62-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/908-65-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/908-57-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/908-67-0x0000000000400000-0x000000000044C000-memory.dmpFilesize
304KB
-
memory/908-70-0x0000000074C90000-0x000000007523B000-memory.dmpFilesize
5.7MB
-
memory/908-71-0x0000000074C90000-0x000000007523B000-memory.dmpFilesize
5.7MB