Analysis

  • max time kernel
    138s
  • max time network
    141s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    23-11-2022 18:30

General

  • Target

    d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe

  • Size

    152KB

  • MD5

    42d3f8095ee81957884ace52a36da770

  • SHA1

    576d8e441be5159240c8a42568518f09a8f7963c

  • SHA256

    d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0

  • SHA512

    be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d

  • SSDEEP

    1536:ryUhRUuyTgLMk2DaTvLvpH+hhTQ2+7Sn7qdZ9h4MVSDoL:rBsh0gJavYv+7oqdZ3HVS

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Loads dropped DLL 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 30 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 6 IoCs
  • Suspicious use of WriteProcessMemory 38 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe
    "C:\Users\Admin\AppData\Local\Temp\d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1748
    • C:\Users\Admin\AppData\Local\Temp\d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe
      "C:\Users\Admin\AppData\Local\Temp\d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0.exe"
      2⤵
      • Loads dropped DLL
      • Adds Run key to start application
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:872
      • C:\Users\Admin\AppData\Roaming\Zyxixh.exe
        "C:\Users\Admin\AppData\Roaming\Zyxixh.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious use of WriteProcessMemory
        PID:1648
        • C:\Users\Admin\AppData\Roaming\Zyxixh.exe
          "C:\Users\Admin\AppData\Roaming\Zyxixh.exe"
          4⤵
          • Executes dropped EXE
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          PID:580
          • C:\Program Files (x86)\Internet Explorer\iexplore.exe
            "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
            5⤵
            • Suspicious use of WriteProcessMemory
            PID:1108
            • C:\Program Files\Internet Explorer\IEXPLORE.EXE
              "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
              6⤵
              • Modifies Internet Explorer settings
              • Suspicious use of FindShellTrayWindow
              • Suspicious use of SetWindowsHookEx
              • Suspicious use of WriteProcessMemory
              PID:1776
              • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
                "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1776 CREDAT:275457 /prefetch:2
                7⤵
                • Modifies Internet Explorer settings
                • Suspicious use of AdjustPrivilegeToken
                • Suspicious use of SetWindowsHookEx
                PID:940

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\X61QLO2V.txt

    Filesize

    608B

    MD5

    7315b79b19811d018793155f0c4be36e

    SHA1

    8ae4959a6a7650b77cd13c71793e252d00eb2235

    SHA256

    acfd0bff5b629bb533258a64a8010d6ccb5640977d1546be8bbdac6073982974

    SHA512

    f88952099d8d09c2399e92adde59ff01cbd092c533d520436096c3c12aa92e3df3d741098fb76f6f4ec669f2fa9e54769b11c3117bded4a63ffee0339f879b3b

  • C:\Users\Admin\AppData\Roaming\Zyxixh.exe

    Filesize

    152KB

    MD5

    42d3f8095ee81957884ace52a36da770

    SHA1

    576d8e441be5159240c8a42568518f09a8f7963c

    SHA256

    d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0

    SHA512

    be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d

  • C:\Users\Admin\AppData\Roaming\Zyxixh.exe

    Filesize

    152KB

    MD5

    42d3f8095ee81957884ace52a36da770

    SHA1

    576d8e441be5159240c8a42568518f09a8f7963c

    SHA256

    d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0

    SHA512

    be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d

  • C:\Users\Admin\AppData\Roaming\Zyxixh.exe

    Filesize

    152KB

    MD5

    42d3f8095ee81957884ace52a36da770

    SHA1

    576d8e441be5159240c8a42568518f09a8f7963c

    SHA256

    d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0

    SHA512

    be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d

  • \Users\Admin\AppData\Roaming\Zyxixh.exe

    Filesize

    152KB

    MD5

    42d3f8095ee81957884ace52a36da770

    SHA1

    576d8e441be5159240c8a42568518f09a8f7963c

    SHA256

    d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0

    SHA512

    be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d

  • \Users\Admin\AppData\Roaming\Zyxixh.exe

    Filesize

    152KB

    MD5

    42d3f8095ee81957884ace52a36da770

    SHA1

    576d8e441be5159240c8a42568518f09a8f7963c

    SHA256

    d8fdba6e9834965a9e0a63a471bcb6f63449fbe5fe049fd9d3ac99d06b011fa0

    SHA512

    be33e69fecdc4607b9adf8f4bb733b099cbd806bb5a91835b00fd94e765c225a58c63f25b1b5132354bcd88f69568793bd3d77c360772c566af4a6b50d860a6d

  • memory/580-93-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/580-92-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/580-86-0x000000000040B200-mapping.dmp

  • memory/872-69-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/872-64-0x000000000040B200-mapping.dmp

  • memory/872-68-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/872-55-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/872-67-0x0000000076191000-0x0000000076193000-memory.dmp

    Filesize

    8KB

  • memory/872-57-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/872-74-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/872-54-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/872-63-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/872-59-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/872-61-0x0000000000400000-0x0000000000429000-memory.dmp

    Filesize

    164KB

  • memory/1648-88-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB

  • memory/1648-72-0x0000000000000000-mapping.dmp

  • memory/1748-65-0x0000000000400000-0x0000000000426000-memory.dmp

    Filesize

    152KB