Analysis
-
max time kernel
161s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 00:32
Static task
static1
Behavioral task
behavioral1
Sample
920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe
Resource
win10v2004-20221111-en
General
-
Target
920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe
-
Size
271KB
-
MD5
3dd67325f180bc48b0cf2c67b13d6320
-
SHA1
8936730b9d112152090b23b62a1442c21cfc3049
-
SHA256
920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32
-
SHA512
721ca105442d2496ce04a3e985506f65b6f27cb76ad676de5f4631154ccbe479083037077aec7b6d9a7c7e931a034fd9cf21158a2fd62cb5c10ffba629823fdb
-
SSDEEP
6144:pvH/Rmo/ToUatAubNawb9VOExRCiMOEoAEzPqGjfRpo:dH4WToX5bswb9VOExxLEBcPdfRp
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 7 IoCs
Processes:
920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Irmon\Parameters\ServiceDll = "C:\\Windows\\system32\\Irmon.dll" 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nla\Parameters\ServiceDll = "C:\\Windows\\system32\\Nla.dll" 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ntmssvc\Parameters\ServiceDll = "C:\\Windows\\system32\\Ntmssvc.dll" 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NWCWorkstation\Parameters\ServiceDll = "C:\\Windows\\system32\\NWCWorkstation.dll" 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Nwsapagent\Parameters\ServiceDll = "C:\\Windows\\system32\\Nwsapagent.dll" 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\FastUserSwitchingCompatibility\Parameters\ServiceDll = "C:\\Windows\\system32\\FastUserSwitchingCompatibility.dll" 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Ias\Parameters\ServiceDll = "C:\\Windows\\system32\\Ias.dll" 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe -
Loads dropped DLL 12 IoCs
Processes:
svchost.exesvchost.exesvchost.exesvchost.exesvchost.exesvchost.exepid process 1000 svchost.exe 1000 svchost.exe 1564 svchost.exe 1564 svchost.exe 628 svchost.exe 628 svchost.exe 1660 svchost.exe 1660 svchost.exe 1524 svchost.exe 1524 svchost.exe 1676 svchost.exe 1676 svchost.exe -
Drops file in System32 directory 7 IoCs
Processes:
920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Nla.dll 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe File opened for modification C:\Windows\SysWOW64\Ntmssvc.dll 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe File opened for modification C:\Windows\SysWOW64\NWCWorkstation.dll 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe File opened for modification C:\Windows\SysWOW64\Nwsapagent.dll 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe File opened for modification C:\Windows\SysWOW64\FastUserSwitchingCompatibility.dll 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe File opened for modification C:\Windows\SysWOW64\Ias.dll 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe File opened for modification C:\Windows\SysWOW64\Irmon.dll 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exepid process 1788 920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe"C:\Users\Admin\AppData\Local\Temp\920d45a7da1a6f9d9ccf7be5ff6c50a44d9143e1b7517663c6454725c898ea32.exe"1⤵
- Sets DLL path for service in the registry
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Loads dropped DLL
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\windows\SysWOW64\fastuserswitchingcompatibility.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\??\c:\windows\SysWOW64\irmon.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\??\c:\windows\SysWOW64\nla.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\??\c:\windows\SysWOW64\ntmssvc.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\??\c:\windows\SysWOW64\nwcworkstation.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\??\c:\windows\SysWOW64\nwsapagent.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\FastUserSwitchingCompatibility.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\FastUserSwitchingCompatibility.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\Irmon.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\Irmon.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\NWCWorkstation.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\NWCWorkstation.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\Nla.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\Nla.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\Ntmssvc.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\Ntmssvc.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\Nwsapagent.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
\Windows\SysWOW64\Nwsapagent.dllFilesize
271KB
MD54a24f81fef4dca075b4808c1c669ec70
SHA1e95271c1298c1a21fe98b527d58fa0133e0ead99
SHA2567df3012d371bb18257e228aa61f7f7ae8e53b4e3d1e96326995d14ea1b2c9cea
SHA512ba19026f82a0d778893bcc9720df639b25a5bd4e5884fba18635d95ab10e23baddc8bd58063adfc73ceaa0187cdc29518ec5f31856a6633c542c27b8c265faf2
-
memory/1788-57-0x0000000000120000-0x0000000000142000-memory.dmpFilesize
136KB
-
memory/1788-56-0x0000000000120000-0x0000000000142000-memory.dmpFilesize
136KB
-
memory/1788-64-0x0000000002210000-0x0000000006210000-memory.dmpFilesize
64.0MB
-
memory/1788-58-0x0000000002210000-0x0000000006210000-memory.dmpFilesize
64.0MB
-
memory/1788-55-0x00000000754F1000-0x00000000754F3000-memory.dmpFilesize
8KB
-
memory/1788-54-0x0000000000010000-0x0000000000032000-memory.dmpFilesize
136KB
-
memory/1788-63-0x0000000000010000-0x0000000000032000-memory.dmpFilesize
136KB