Analysis
-
max time kernel
151s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 03:47
Static task
static1
Behavioral task
behavioral1
Sample
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
Resource
win10v2004-20220901-en
General
-
Target
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
-
Size
180KB
-
MD5
f96874ad23fde2f0b3af2af1565beb73
-
SHA1
16e63fa7df0f2e8964d2e9cf2541b9ccd5c31106
-
SHA256
0ed91af7f5dd71ee724ef0bddaae43bdd10721fa21f2b226f69f3156085126fc
-
SHA512
e5c621a7bd62832ba331b2d0ee40d72e81d9a6892a662ded20c1c23e56b553b829f1691293728b1a8d190c6dd3c0dfdccfe77551ebe2bf7e3220d411c77e803d
-
SSDEEP
3072:t1ezQdDuZph4fWy6c3v40y+rzqVCr+YARsI6u2t4Y9sBG0hac0v2D+:t1eUNuFIdt3vTrz1r+R7F2t4pUO
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1744 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\"" Explorer.EXE -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exeExplorer.EXEpid process 1064 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 1064 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1064 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe Token: SeDebugPrivilege 1360 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE 1360 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1360 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exeExplorer.EXEdescription pid process target process PID 1064 wrote to memory of 1744 1064 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe cmd.exe PID 1064 wrote to memory of 1744 1064 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe cmd.exe PID 1064 wrote to memory of 1744 1064 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe cmd.exe PID 1064 wrote to memory of 1744 1064 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe cmd.exe PID 1064 wrote to memory of 1360 1064 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe Explorer.EXE PID 1360 wrote to memory of 1216 1360 Explorer.EXE taskhost.exe PID 1360 wrote to memory of 1304 1360 Explorer.EXE Dwm.exe PID 1360 wrote to memory of 1744 1360 Explorer.EXE cmd.exe PID 1360 wrote to memory of 1744 1360 Explorer.EXE cmd.exe PID 1360 wrote to memory of 932 1360 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe"C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS9082~1.BAT"3⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-715191760-57414214-11643523119832849141675357816-1177009152-2057146821568550722"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms9082233.batFilesize
201B
MD5b70b031cf66db36a9101e5752df4abb6
SHA1fa2e149f67a327c71c0836aba2f3478a641d72a2
SHA2562b7b987dd8c82cc70621daa39a11a81e34f71b02ba6154c0ddd90565b350844f
SHA5121c4f617810526f2163dbe89486214c60d30fedbcfd944422f673a35a1ef5ddc17924ea14c2a1726ec844f235b9498878d809822302be24c9ddbbf071dbce9648
-
memory/932-74-0x00000000000D0000-0x00000000000E7000-memory.dmpFilesize
92KB
-
memory/1064-59-0x0000000001340000-0x0000000001375000-memory.dmpFilesize
212KB
-
memory/1064-54-0x0000000075BB1000-0x0000000075BB3000-memory.dmpFilesize
8KB
-
memory/1064-58-0x00000000001D0000-0x00000000001DD000-memory.dmpFilesize
52KB
-
memory/1216-72-0x0000000037570000-0x0000000037580000-memory.dmpFilesize
64KB
-
memory/1216-75-0x0000000001BE0000-0x0000000001BF7000-memory.dmpFilesize
92KB
-
memory/1304-73-0x0000000037570000-0x0000000037580000-memory.dmpFilesize
64KB
-
memory/1304-77-0x00000000001B0000-0x00000000001C7000-memory.dmpFilesize
92KB
-
memory/1360-60-0x0000000037570000-0x0000000037580000-memory.dmpFilesize
64KB
-
memory/1360-56-0x00000000021F0000-0x0000000002207000-memory.dmpFilesize
92KB
-
memory/1360-76-0x00000000021F0000-0x0000000002207000-memory.dmpFilesize
92KB
-
memory/1360-78-0x00000000021F0000-0x0000000002207000-memory.dmpFilesize
92KB
-
memory/1744-65-0x00000000000F0000-0x0000000000104000-memory.dmpFilesize
80KB
-
memory/1744-55-0x0000000000000000-mapping.dmp