Analysis
-
max time kernel
147s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 22:25
Static task
static1
Behavioral task
behavioral1
Sample
8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe
Resource
win10v2004-20220812-en
General
-
Target
8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe
-
Size
160KB
-
MD5
01183166fbe73829f070df7f433535af
-
SHA1
12dba89f2c869ff6f12f8005dfb004628e2c983d
-
SHA256
8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2
-
SHA512
f8f063332a9c68eee507b0131011f577be2e6115991be36721c7dacc723ae0afe78c63e8e58c1f42d32f86475a82f40a4d123d66e4364bf3ad62418062325e56
-
SSDEEP
3072:KSoqfIPMILiKeWc92Q8wyyfmsaPFwyv9AvEcsmB5Oa0q/2uCzak:HIUILNisDyfmVuxMZq/z8ak
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
Explorer.EXEpid process 2560 Explorer.EXE -
Registers COM server for autorun 1 TTPs 3 IoCs
Processes:
8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2629973501-4017243118-3254762364-1000\\$8dceb85e8508ee5bcccc98a6b145e6ef\\n." 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe -
Unexpected DNS network traffic destination 10 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
Processes:
description ioc Destination IP 91.195.254.70 Destination IP 91.195.254.70 Destination IP 91.195.254.70 Destination IP 91.195.254.70 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 91.195.254.70 Destination IP 66.85.130.234 -
Modifies registry class 5 IoCs
Processes:
8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-2629973501-4017243118-3254762364-1000\\$8dceb85e8508ee5bcccc98a6b145e6ef\\n." 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\clsid 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000_Classes\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exepid process 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2560 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exedescription pid process Token: SeDebugPrivilege 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe Token: SeDebugPrivilege 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe Token: SeDebugPrivilege 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe -
Suspicious use of WriteProcessMemory 2 IoCs
Processes:
8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exedescription pid process target process PID 4892 wrote to memory of 2560 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe Explorer.EXE PID 4892 wrote to memory of 2560 4892 8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
PID:2560 -
C:\Users\Admin\AppData\Local\Temp\8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe"C:\Users\Admin\AppData\Local\Temp\8dee4abfdb21c3f74100f83f388a350e8dbef4c2740a1a9e37fee293f6e09cd2.exe"2⤵
- Registers COM server for autorun
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4892
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\$8dceb85e8508ee5bcccc98a6b145e6ef\nFilesize
25KB
MD5031f24073b43717e018ba0c5f62cb0c2
SHA1504008e17d774bdfd3996ce8cf521277ca620ca9
SHA2569abdc34bee90330fa2505f0c3f74eda6036e5adf22cc8bcd57192d0bf6f17946
SHA512c9a163bc5cd6171013e38ee418737f0ee383b733090648d8879b259b0659d803c23d2e62b6e34e9897c436f35984ccc4f29d552a975f03292774834279f07d37
-
C:\$Recycle.Bin\S-1-5-21-2629973501-4017243118-3254762364-1000\$8dceb85e8508ee5bcccc98a6b145e6ef\nFilesize
25KB
MD5031f24073b43717e018ba0c5f62cb0c2
SHA1504008e17d774bdfd3996ce8cf521277ca620ca9
SHA2569abdc34bee90330fa2505f0c3f74eda6036e5adf22cc8bcd57192d0bf6f17946
SHA512c9a163bc5cd6171013e38ee418737f0ee383b733090648d8879b259b0659d803c23d2e62b6e34e9897c436f35984ccc4f29d552a975f03292774834279f07d37
-
memory/4892-132-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/4892-133-0x00000000004C2000-0x00000000004E1000-memory.dmpFilesize
124KB
-
memory/4892-136-0x0000000000400000-0x0000000000436000-memory.dmpFilesize
216KB
-
memory/4892-137-0x00000000004C2000-0x00000000004E1000-memory.dmpFilesize
124KB