Analysis
-
max time kernel
146s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 13:47
Static task
static1
Behavioral task
behavioral1
Sample
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe
Resource
win10v2004-20221111-en
General
-
Target
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe
-
Size
255KB
-
MD5
aed2c210d8388d109b5e2e50f4c09e1b
-
SHA1
fb9845a0597d7e2f7051a5e000fc1276d2746b15
-
SHA256
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee
-
SHA512
a32bb8df1bd88b042b34fdeca037bc737d02d9bbf2f353caaaed6e5ba335434959b827002c1b1c76d4bf943e972adbda98b74277c157094f4306c9bdbf5a4d6b
-
SSDEEP
6144:ncKreOw1Alj3jJ5teqA63G40ES16UAAEm4:ncKreOw1AlZ5tL3DE6Uhv4
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exenotepad.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Jdoeon = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Jdoeon.exe" notepad.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exenotepad.exedescription ioc process File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\D: notepad.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\X: svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exedescription pid process target process PID 1348 set thread context of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1864 set thread context of 1440 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exesvchost.exe850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exepid process 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 1428 svchost.exe 1440 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exepid process 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exesvchost.execalc.exenotepad.exedescription pid process Token: SeDebugPrivilege 1440 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe Token: SeDebugPrivilege 1428 svchost.exe Token: SeDebugPrivilege 1672 calc.exe Token: SeDebugPrivilege 892 notepad.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exesvchost.exe850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exedescription pid process target process PID 1348 wrote to memory of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1348 wrote to memory of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1348 wrote to memory of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1348 wrote to memory of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1348 wrote to memory of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1348 wrote to memory of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1348 wrote to memory of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1348 wrote to memory of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1348 wrote to memory of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1348 wrote to memory of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1348 wrote to memory of 1864 1348 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1864 wrote to memory of 1672 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1864 wrote to memory of 1672 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1864 wrote to memory of 1672 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1864 wrote to memory of 1672 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1864 wrote to memory of 1672 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1864 wrote to memory of 1428 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe svchost.exe PID 1864 wrote to memory of 1428 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe svchost.exe PID 1864 wrote to memory of 1428 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe svchost.exe PID 1864 wrote to memory of 1428 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe svchost.exe PID 1864 wrote to memory of 1428 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe svchost.exe PID 1864 wrote to memory of 1672 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1428 wrote to memory of 892 1428 svchost.exe notepad.exe PID 1428 wrote to memory of 892 1428 svchost.exe notepad.exe PID 1428 wrote to memory of 892 1428 svchost.exe notepad.exe PID 1428 wrote to memory of 892 1428 svchost.exe notepad.exe PID 1428 wrote to memory of 892 1428 svchost.exe notepad.exe PID 1864 wrote to memory of 1440 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1864 wrote to memory of 1440 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1864 wrote to memory of 1440 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1864 wrote to memory of 1440 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1864 wrote to memory of 1440 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1864 wrote to memory of 1440 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1864 wrote to memory of 1440 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1864 wrote to memory of 1440 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1864 wrote to memory of 1440 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1864 wrote to memory of 1440 1864 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe PID 1440 wrote to memory of 1428 1440 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe svchost.exe PID 1440 wrote to memory of 1428 1440 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe svchost.exe PID 1440 wrote to memory of 1672 1440 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1440 wrote to memory of 1672 1440 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe calc.exe PID 1440 wrote to memory of 892 1440 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe notepad.exe PID 1440 wrote to memory of 892 1440 850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe"C:\Users\Admin\AppData\Local\Temp\850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe"C:\Users\Admin\AppData\Local\Temp\850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\SysWOW64\notepad.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe"C:\Users\Admin\AppData\Local\Temp\850bc78962e392669c8732c848a804f531465c64879cec680d2c9025ab6f8aee.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/892-78-0x0000000000000000-mapping.dmp
-
memory/892-344-0x00000000002D0000-0x000000000031E000-memory.dmpFilesize
312KB
-
memory/892-130-0x00000000002D0000-0x000000000031E000-memory.dmpFilesize
312KB
-
memory/892-119-0x00000000002D0000-0x000000000031E000-memory.dmpFilesize
312KB
-
memory/892-95-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/892-83-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/892-82-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/892-81-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/892-80-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1348-65-0x0000000000220000-0x0000000000234000-memory.dmpFilesize
80KB
-
memory/1428-110-0x00000000000E0000-0x000000000012E000-memory.dmpFilesize
312KB
-
memory/1428-91-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1428-72-0x0000000000000000-mapping.dmp
-
memory/1428-342-0x00000000000E0000-0x000000000012E000-memory.dmpFilesize
312KB
-
memory/1428-116-0x00000000000E0000-0x000000000012E000-memory.dmpFilesize
312KB
-
memory/1428-107-0x00000000000E0000-0x000000000012E000-memory.dmpFilesize
312KB
-
memory/1428-131-0x00000000000E0000-0x000000000012E000-memory.dmpFilesize
312KB
-
memory/1428-126-0x00000000000E0000-0x000000000012E000-memory.dmpFilesize
312KB
-
memory/1440-85-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1440-101-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1440-87-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1440-90-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1440-84-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1440-94-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1440-123-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1440-97-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1440-98-0x0000000000410910-mapping.dmp
-
memory/1440-102-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1672-93-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/1672-124-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1672-73-0x0000000000000000-mapping.dmp
-
memory/1672-343-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1672-112-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1672-68-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/1672-117-0x00000000003A0000-0x00000000003EE000-memory.dmpFilesize
312KB
-
memory/1864-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1864-62-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1864-89-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1864-59-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1864-64-0x00000000004045C0-mapping.dmp
-
memory/1864-55-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1864-67-0x0000000075601000-0x0000000075603000-memory.dmpFilesize
8KB
-
memory/1864-54-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1864-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1864-57-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB