Analysis
-
max time kernel
41s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
23-11-2022 17:17
Behavioral task
behavioral1
Sample
63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe
Resource
win7-20220812-en
General
-
Target
63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe
-
Size
550KB
-
MD5
444bbc03af7524f7c8d5303d34e34358
-
SHA1
6cf5d9d49b71e5e614682690b5e1997710a0aec0
-
SHA256
63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3
-
SHA512
7d8dd8a915d4ca703ca0cca15351b137263a992216e7775146effe590507eaa8460c9e8bfd0aa19d0ae155981b62413f38e9eb2d83af3db60f7b4587b6392b9c
-
SSDEEP
12288:2PaYD4dhDccAXN/FDzq/nAKaO7J6eDy2CjkOR1N:2PjDIicyN/5q/2O7JWjnR1N
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exepid process 1896 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe upx \Users\Admin\AppData\Local\Temp\63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe upx C:\Users\Admin\AppData\Local\Temp\63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe upx behavioral1/memory/1912-58-0x0000000000400000-0x00000000004D0000-memory.dmp upx behavioral1/memory/1896-59-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Loads dropped DLL 2 IoCs
Processes:
63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exepid process 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exepid process 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1896 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe 1896 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe -
Suspicious behavior: MapViewOfSection 23 IoCs
Processes:
63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exepid process 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exedescription pid process Token: SeDebugPrivilege 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe Token: SeDebugPrivilege 1896 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exedescription pid process target process PID 1912 wrote to memory of 1896 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe PID 1912 wrote to memory of 1896 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe PID 1912 wrote to memory of 1896 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe PID 1912 wrote to memory of 1896 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe PID 1912 wrote to memory of 368 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe wininit.exe PID 1912 wrote to memory of 368 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe wininit.exe PID 1912 wrote to memory of 368 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe wininit.exe PID 1912 wrote to memory of 368 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe wininit.exe PID 1912 wrote to memory of 368 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe wininit.exe PID 1912 wrote to memory of 380 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe csrss.exe PID 1912 wrote to memory of 380 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe csrss.exe PID 1912 wrote to memory of 380 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe csrss.exe PID 1912 wrote to memory of 380 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe csrss.exe PID 1912 wrote to memory of 380 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe csrss.exe PID 1912 wrote to memory of 416 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe winlogon.exe PID 1912 wrote to memory of 416 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe winlogon.exe PID 1912 wrote to memory of 416 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe winlogon.exe PID 1912 wrote to memory of 416 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe winlogon.exe PID 1912 wrote to memory of 416 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe winlogon.exe PID 1912 wrote to memory of 460 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe services.exe PID 1912 wrote to memory of 460 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe services.exe PID 1912 wrote to memory of 460 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe services.exe PID 1912 wrote to memory of 460 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe services.exe PID 1912 wrote to memory of 460 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe services.exe PID 1912 wrote to memory of 476 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe lsass.exe PID 1912 wrote to memory of 476 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe lsass.exe PID 1912 wrote to memory of 476 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe lsass.exe PID 1912 wrote to memory of 476 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe lsass.exe PID 1912 wrote to memory of 476 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe lsass.exe PID 1912 wrote to memory of 484 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe lsm.exe PID 1912 wrote to memory of 484 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe lsm.exe PID 1912 wrote to memory of 484 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe lsm.exe PID 1912 wrote to memory of 484 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe lsm.exe PID 1912 wrote to memory of 484 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe lsm.exe PID 1912 wrote to memory of 592 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 592 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 592 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 592 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 592 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 672 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 672 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 672 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 672 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 672 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 768 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 768 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 768 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 768 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 768 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 816 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 816 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 816 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 816 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 816 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 840 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 840 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 840 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 840 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 840 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 884 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 884 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 884 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 884 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe PID 1912 wrote to memory of 884 1912 63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe svchost.exe
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe2⤵
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe"C:\Users\Admin\AppData\Local\Temp\63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exeC:\Users\Admin\AppData\Local\Temp\63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exeFilesize
132KB
MD567de3e26d97b1382e88036515ddf646a
SHA1f4634a54e14f8c3dd9eec232cbdd03eb0f6043da
SHA256e60f9d78d1c5e97a51ea8c219706af77014498847b1eba2a6f6110b527e9b375
SHA512dbc1036a399d4fa5e7f7a2a9450468bfec5ef37119a52a17d450a06fc953751d7bef72b22e7d7b705accca6c223b832626e42c619e799b9e4d21fce3b9c87352
-
\Users\Admin\AppData\Local\Temp\63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exeFilesize
132KB
MD567de3e26d97b1382e88036515ddf646a
SHA1f4634a54e14f8c3dd9eec232cbdd03eb0f6043da
SHA256e60f9d78d1c5e97a51ea8c219706af77014498847b1eba2a6f6110b527e9b375
SHA512dbc1036a399d4fa5e7f7a2a9450468bfec5ef37119a52a17d450a06fc953751d7bef72b22e7d7b705accca6c223b832626e42c619e799b9e4d21fce3b9c87352
-
\Users\Admin\AppData\Local\Temp\63592f1efd144c4dab069625fac68e7155095377378837600bf49b5c196e8ce3mgr.exeFilesize
132KB
MD567de3e26d97b1382e88036515ddf646a
SHA1f4634a54e14f8c3dd9eec232cbdd03eb0f6043da
SHA256e60f9d78d1c5e97a51ea8c219706af77014498847b1eba2a6f6110b527e9b375
SHA512dbc1036a399d4fa5e7f7a2a9450468bfec5ef37119a52a17d450a06fc953751d7bef72b22e7d7b705accca6c223b832626e42c619e799b9e4d21fce3b9c87352
-
memory/1896-56-0x0000000000000000-mapping.dmp
-
memory/1896-59-0x0000000000400000-0x000000000045D000-memory.dmpFilesize
372KB
-
memory/1896-60-0x000000007EFA0000-0x000000007EFA8000-memory.dmpFilesize
32KB
-
memory/1912-58-0x0000000000400000-0x00000000004D0000-memory.dmpFilesize
832KB