Analysis
-
max time kernel
129s -
max time network
33s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 01:14
Static task
static1
Behavioral task
behavioral1
Sample
ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe
Resource
win10v2004-20220812-en
General
-
Target
ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe
-
Size
74KB
-
MD5
0335bf2b061afacdf66c00dd51ee7da4
-
SHA1
1c44a285667df5b68f60b02b20f489f78f3180c0
-
SHA256
ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d
-
SHA512
7a7c415c29fe12298ecb55adbfc6f0974f3c366276ebd1898c9ae1260700b0806ea97bd4e06c277852d648a78e4f587c5304ecd26a73e085275ee16e74c845eb
-
SSDEEP
1536:BV+rXj8M7RrQR51HCHmnKlX16N625h2YuDEm1lSa47fM76jaKLM8Ai2p:Y8EE5iHmnKlX1M625h1uDxUa47fM76BQ
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-575491160-2295418218-1540667289-1000\Software\Microsoft\Windows\CurrentVersion\Run\Serverx = "C:\\Windows\\system32\\Serverx.exe" ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe -
Drops file in System32 directory 3 IoCs
Processes:
ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exedescription ioc process File created C:\Windows\SysWOW64\Serverx.exe ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe File opened for modification C:\WINDOWS\SysWOW64\SERVERX.EXE ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe File opened for modification C:\Windows\SysWOW64\Serverx.exe ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exepid process 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe -
Suspicious behavior: MapViewOfSection 23 IoCs
Processes:
ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exepid process 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exeba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exedescription pid process Token: SeDebugPrivilege 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe Token: SeTakeOwnershipPrivilege 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe Token: SeRestorePrivilege 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe Token: SeBackupPrivilege 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe Token: SeChangeNotifyPrivilege 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe Token: SeTakeOwnershipPrivilege 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe Token: SeRestorePrivilege 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe Token: SeBackupPrivilege 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe Token: SeChangeNotifyPrivilege 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
Processes:
ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exeba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exedescription pid process target process PID 1428 wrote to memory of 1532 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe PID 1428 wrote to memory of 1532 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe PID 1428 wrote to memory of 1532 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe PID 1428 wrote to memory of 1532 1428 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe PID 1532 wrote to memory of 368 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe wininit.exe PID 1532 wrote to memory of 368 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe wininit.exe PID 1532 wrote to memory of 368 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe wininit.exe PID 1532 wrote to memory of 368 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe wininit.exe PID 1532 wrote to memory of 368 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe wininit.exe PID 1532 wrote to memory of 380 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe csrss.exe PID 1532 wrote to memory of 380 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe csrss.exe PID 1532 wrote to memory of 380 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe csrss.exe PID 1532 wrote to memory of 380 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe csrss.exe PID 1532 wrote to memory of 380 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe csrss.exe PID 1532 wrote to memory of 416 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe winlogon.exe PID 1532 wrote to memory of 416 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe winlogon.exe PID 1532 wrote to memory of 416 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe winlogon.exe PID 1532 wrote to memory of 416 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe winlogon.exe PID 1532 wrote to memory of 416 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe winlogon.exe PID 1532 wrote to memory of 460 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe services.exe PID 1532 wrote to memory of 460 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe services.exe PID 1532 wrote to memory of 460 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe services.exe PID 1532 wrote to memory of 460 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe services.exe PID 1532 wrote to memory of 460 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe services.exe PID 1532 wrote to memory of 476 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe lsass.exe PID 1532 wrote to memory of 476 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe lsass.exe PID 1532 wrote to memory of 476 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe lsass.exe PID 1532 wrote to memory of 476 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe lsass.exe PID 1532 wrote to memory of 476 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe lsass.exe PID 1532 wrote to memory of 484 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe lsm.exe PID 1532 wrote to memory of 484 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe lsm.exe PID 1532 wrote to memory of 484 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe lsm.exe PID 1532 wrote to memory of 484 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe lsm.exe PID 1532 wrote to memory of 484 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe lsm.exe PID 1532 wrote to memory of 596 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 596 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 596 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 596 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 596 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 676 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 676 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 676 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 676 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 676 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 760 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 760 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 760 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 760 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 760 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 804 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 804 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 804 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 804 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 804 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 844 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 844 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 844 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 844 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 844 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 880 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 880 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 880 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 880 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe PID 1532 wrote to memory of 880 1532 ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe svchost.exe
Processes
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe"C:\Users\Admin\AppData\Local\Temp\ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe"2⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe"C:\Users\Admin\AppData\Local\Temp\ba61b5b4203f910aa1cdd95709e898896e1cebd12bd36422d8da0111196c826d.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork1⤵
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted1⤵
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch1⤵
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
-
C:\Windows\system32\wininit.exewininit.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1252-61-0x0000000002910000-0x0000000002911000-memory.dmpFilesize
4KB
-
memory/1428-54-0x0000000074C41000-0x0000000074C43000-memory.dmpFilesize
8KB
-
memory/1428-58-0x0000000001000000-0x000000000101A000-memory.dmpFilesize
104KB
-
memory/1428-59-0x00000000001F0000-0x000000000020A000-memory.dmpFilesize
104KB
-
memory/1428-60-0x000000007EFA0000-0x000000007EFA8000-memory.dmpFilesize
32KB
-
memory/1428-63-0x000000007EFA0000-0x000000007EFA8000-memory.dmpFilesize
32KB
-
memory/1428-64-0x0000000001000000-0x000000000101A000-memory.dmpFilesize
104KB
-
memory/1428-65-0x00000000001F0000-0x000000000020A000-memory.dmpFilesize
104KB
-
memory/1532-55-0x0000000000000000-mapping.dmp
-
memory/1532-57-0x0000000001000000-0x000000000101A000-memory.dmpFilesize
104KB