Analysis
-
max time kernel
148s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 01:04
Behavioral task
behavioral1
Sample
73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe
Resource
win10v2004-20221111-en
General
-
Target
73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe
-
Size
88KB
-
MD5
0870eae11b4cd70716cfdd010e800b11
-
SHA1
4cf6be511a020f096580cb641868f84e1f56f8ca
-
SHA256
73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db
-
SHA512
4524abbcb7a918c74c2139f4791a605fd13b3f57c1133225fb4d7e981de1ca08fd3a8aced294a71c4e802db38da22358bb33f0e70c01f5208b934a13c413ac77
-
SSDEEP
1536:09t/yuWliX2ZqEulssTvCfsNO5YHAwXC5apqS1sb8DyxaA9vMeC5wQ:039EuWsTqfsNdHL83SjDxB
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
Processes:
73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\M-8597378998674567\winmgr.exe = "C:\\Users\\Admin\\M-8597378998674567\\winmgr.exe:*:Enabled:Microsoft Windows Service" 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe -
Executes dropped EXE 2 IoCs
Processes:
winmgr.exewinmgr.exepid process 1364 winmgr.exe 820 winmgr.exe -
Processes:
resource yara_rule behavioral1/memory/864-54-0x0000000000400000-0x0000000000440000-memory.dmp upx behavioral1/memory/864-67-0x0000000000400000-0x0000000000440000-memory.dmp upx \Users\Admin\M-8597378998674567\winmgr.exe upx C:\Users\Admin\M-8597378998674567\winmgr.exe upx behavioral1/memory/1364-74-0x0000000000400000-0x0000000000440000-memory.dmp upx C:\Users\Admin\M-8597378998674567\winmgr.exe upx behavioral1/memory/1364-89-0x0000000000400000-0x0000000000440000-memory.dmp upx -
Loads dropped DLL 1 IoCs
Processes:
73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exepid process 1756 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Service = "C:\\Users\\Admin\\M-8597378998674567\\winmgr.exe" 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exewinmgr.exedescription pid process target process PID 864 set thread context of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 1364 set thread context of 820 1364 winmgr.exe winmgr.exe -
Suspicious use of WriteProcessMemory 26 IoCs
Processes:
73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exewinmgr.exedescription pid process target process PID 864 wrote to memory of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 864 wrote to memory of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 864 wrote to memory of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 864 wrote to memory of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 864 wrote to memory of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 864 wrote to memory of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 864 wrote to memory of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 864 wrote to memory of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 864 wrote to memory of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 864 wrote to memory of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 864 wrote to memory of 1756 864 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe PID 1756 wrote to memory of 1364 1756 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe winmgr.exe PID 1756 wrote to memory of 1364 1756 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe winmgr.exe PID 1756 wrote to memory of 1364 1756 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe winmgr.exe PID 1756 wrote to memory of 1364 1756 73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe winmgr.exe PID 1364 wrote to memory of 820 1364 winmgr.exe winmgr.exe PID 1364 wrote to memory of 820 1364 winmgr.exe winmgr.exe PID 1364 wrote to memory of 820 1364 winmgr.exe winmgr.exe PID 1364 wrote to memory of 820 1364 winmgr.exe winmgr.exe PID 1364 wrote to memory of 820 1364 winmgr.exe winmgr.exe PID 1364 wrote to memory of 820 1364 winmgr.exe winmgr.exe PID 1364 wrote to memory of 820 1364 winmgr.exe winmgr.exe PID 1364 wrote to memory of 820 1364 winmgr.exe winmgr.exe PID 1364 wrote to memory of 820 1364 winmgr.exe winmgr.exe PID 1364 wrote to memory of 820 1364 winmgr.exe winmgr.exe PID 1364 wrote to memory of 820 1364 winmgr.exe winmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe"C:\Users\Admin\AppData\Local\Temp\73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe"C:\Users\Admin\AppData\Local\Temp\73bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db.exe"2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\M-8597378998674567\winmgr.exeC:\Users\Admin\M-8597378998674567\winmgr.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\M-8597378998674567\winmgr.exeC:\Users\Admin\M-8597378998674567\winmgr.exe4⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\M-8597378998674567\winmgr.exeFilesize
88KB
MD50870eae11b4cd70716cfdd010e800b11
SHA14cf6be511a020f096580cb641868f84e1f56f8ca
SHA25673bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db
SHA5124524abbcb7a918c74c2139f4791a605fd13b3f57c1133225fb4d7e981de1ca08fd3a8aced294a71c4e802db38da22358bb33f0e70c01f5208b934a13c413ac77
-
C:\Users\Admin\M-8597378998674567\winmgr.exeFilesize
88KB
MD50870eae11b4cd70716cfdd010e800b11
SHA14cf6be511a020f096580cb641868f84e1f56f8ca
SHA25673bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db
SHA5124524abbcb7a918c74c2139f4791a605fd13b3f57c1133225fb4d7e981de1ca08fd3a8aced294a71c4e802db38da22358bb33f0e70c01f5208b934a13c413ac77
-
\Users\Admin\M-8597378998674567\winmgr.exeFilesize
88KB
MD50870eae11b4cd70716cfdd010e800b11
SHA14cf6be511a020f096580cb641868f84e1f56f8ca
SHA25673bd58a5541532aff0692432c0d7cfc91ab8bbe60c49e6d1b5a5f22bbe6771db
SHA5124524abbcb7a918c74c2139f4791a605fd13b3f57c1133225fb4d7e981de1ca08fd3a8aced294a71c4e802db38da22358bb33f0e70c01f5208b934a13c413ac77
-
memory/820-92-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/820-91-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/820-86-0x00000000004069F6-mapping.dmp
-
memory/864-55-0x0000000075141000-0x0000000075143000-memory.dmpFilesize
8KB
-
memory/864-54-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/864-67-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1364-89-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1364-74-0x0000000000400000-0x0000000000440000-memory.dmpFilesize
256KB
-
memory/1364-72-0x0000000000000000-mapping.dmp
-
memory/1756-62-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1756-70-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1756-69-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1756-66-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1756-65-0x00000000004069F6-mapping.dmp
-
memory/1756-64-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1756-63-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1756-61-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1756-59-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB
-
memory/1756-56-0x0000000000400000-0x000000000040D000-memory.dmpFilesize
52KB