Analysis
-
max time kernel
152s -
max time network
163s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
23-11-2022 16:53
Static task
static1
Behavioral task
behavioral1
Sample
70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe
Resource
win10v2004-20220812-en
General
-
Target
70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe
-
Size
211KB
-
MD5
3f68886e4974aa2cda27e7ebd4577488
-
SHA1
a21326daa72e09db39a61c13258adb9737deac0e
-
SHA256
70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8
-
SHA512
7f4e262847795f5371823b1bf5dbcf461774382d03dc8c653fba7b9261a4bbc55c778101e93f20241b41add223d3ed8cddbae3a80c980a846893a3a506f0d732
-
SSDEEP
3072:WfJ4pUdCdc0E+/tYByANc/sg1WyQmG07nMzHrscxO9xEtobhlL5WN:WfJ4GCdlEQtGaWcGQiLnxO9xEto9lu
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4844-133-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral2/memory/4844-136-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral2/memory/4308-140-0x00000000012B0000-0x00000000012D9000-memory.dmp cryptone behavioral2/memory/4308-141-0x00000000012B0000-0x00000000012D9000-memory.dmp cryptone behavioral2/memory/4308-142-0x00000000012B0000-0x00000000012D9000-memory.dmp cryptone behavioral2/memory/4844-147-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral2/memory/1776-150-0x0000000000FC0000-0x0000000000FE9000-memory.dmp cryptone -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exemspaint.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Wwvrvn = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Wwvrvn.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exemspaint.exedescription ioc process File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\Z: svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exedescription pid process target process PID 1564 set thread context of 4844 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 4844 set thread context of 1548 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exesvchost.exe70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exepid process 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 1776 svchost.exe 1776 svchost.exe 1548 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 1548 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 1548 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exepid process 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exesvchost.exemspaint.execalc.exedescription pid process Token: SeDebugPrivilege 1548 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe Token: SeDebugPrivilege 1776 svchost.exe Token: SeDebugPrivilege 4308 mspaint.exe Token: SeDebugPrivilege 3084 calc.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exesvchost.exe70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exedescription pid process target process PID 1564 wrote to memory of 4844 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 1564 wrote to memory of 4844 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 1564 wrote to memory of 4844 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 1564 wrote to memory of 4844 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 1564 wrote to memory of 4844 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 1564 wrote to memory of 4844 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 1564 wrote to memory of 4844 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 1564 wrote to memory of 4844 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 1564 wrote to memory of 4844 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 1564 wrote to memory of 4844 1564 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 4844 wrote to memory of 1776 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe svchost.exe PID 4844 wrote to memory of 1776 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe svchost.exe PID 4844 wrote to memory of 1776 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe svchost.exe PID 4844 wrote to memory of 1776 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe svchost.exe PID 4844 wrote to memory of 3084 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe calc.exe PID 4844 wrote to memory of 3084 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe calc.exe PID 4844 wrote to memory of 3084 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe calc.exe PID 4844 wrote to memory of 3084 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe calc.exe PID 4844 wrote to memory of 3084 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe calc.exe PID 1776 wrote to memory of 4308 1776 svchost.exe mspaint.exe PID 1776 wrote to memory of 4308 1776 svchost.exe mspaint.exe PID 1776 wrote to memory of 4308 1776 svchost.exe mspaint.exe PID 1776 wrote to memory of 4308 1776 svchost.exe mspaint.exe PID 4844 wrote to memory of 1548 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 4844 wrote to memory of 1548 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 4844 wrote to memory of 1548 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 4844 wrote to memory of 1548 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 4844 wrote to memory of 1548 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 4844 wrote to memory of 1548 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 4844 wrote to memory of 1548 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 4844 wrote to memory of 1548 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 4844 wrote to memory of 1548 4844 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe PID 1548 wrote to memory of 1776 1548 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe svchost.exe PID 1548 wrote to memory of 1776 1548 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe svchost.exe PID 1548 wrote to memory of 3084 1548 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe calc.exe PID 1548 wrote to memory of 3084 1548 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe calc.exe PID 1548 wrote to memory of 4308 1548 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe mspaint.exe PID 1548 wrote to memory of 4308 1548 70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe"C:\Users\Admin\AppData\Local\Temp\70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe"C:\Users\Admin\AppData\Local\Temp\70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\SysWOW64\mspaint.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe"C:\Users\Admin\AppData\Local\Temp\70bb37aed4406a1fd15a466095198b562da388a9525e5f6bc6c899ab2b9e9eb8.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1548-144-0x0000000000000000-mapping.dmp
-
memory/1548-152-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1548-149-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1548-148-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1548-145-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1564-134-0x0000000002180000-0x0000000002194000-memory.dmpFilesize
80KB
-
memory/1776-137-0x0000000000000000-mapping.dmp
-
memory/1776-153-0x0000000001210000-0x000000000125E000-memory.dmpFilesize
312KB
-
memory/1776-150-0x0000000000FC0000-0x0000000000FE9000-memory.dmpFilesize
164KB
-
memory/3084-138-0x0000000000000000-mapping.dmp
-
memory/3084-154-0x0000000002E30000-0x0000000002E7E000-memory.dmpFilesize
312KB
-
memory/4308-139-0x0000000000000000-mapping.dmp
-
memory/4308-140-0x00000000012B0000-0x00000000012D9000-memory.dmpFilesize
164KB
-
memory/4308-142-0x00000000012B0000-0x00000000012D9000-memory.dmpFilesize
164KB
-
memory/4308-151-0x00000000012B0000-0x00000000012D9000-memory.dmpFilesize
164KB
-
memory/4308-143-0x00000000012B0000-0x00000000012D9000-memory.dmpFilesize
164KB
-
memory/4308-141-0x00000000012B0000-0x00000000012D9000-memory.dmpFilesize
164KB
-
memory/4308-155-0x00000000012F0000-0x000000000133E000-memory.dmpFilesize
312KB
-
memory/4308-156-0x00000000012F0000-0x000000000133E000-memory.dmpFilesize
312KB
-
memory/4844-132-0x0000000000000000-mapping.dmp
-
memory/4844-147-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4844-136-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4844-133-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB