Analysis
-
max time kernel
167s -
max time network
205s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 04:23
Static task
static1
Behavioral task
behavioral1
Sample
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe
Resource
win10v2004-20220812-en
General
-
Target
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe
-
Size
196KB
-
MD5
fbc0d92f2f004428671631c74da80b4a
-
SHA1
f3f2933db39c9368885854fe522105414d73bc97
-
SHA256
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176
-
SHA512
114c95ba4fc8823dfa9fbfa48eea0a8fc82edbafded6d29e2dbf4e77fd1328150db1541d6bc75df218a0e1ed70c5068930ccdc73dd95dba153151174178c4268
-
SSDEEP
3072:9udusODvGZVHhXwdrkr3k17awTtgXOahnEhHP+2lqKA8ZQ2VwDNNK8N58Tbntd+z:59+phXUHTS/hEhHW8G8ZpGhNzSuz
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 2036 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\gtntglna.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\gtntglna.exe\"" Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exedescription pid process target process PID 1432 set thread context of 1400 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe -
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exef01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exeExplorer.EXEpid process 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe 1400 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe 1400 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 1400 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe Token: SeDebugPrivilege 1376 Explorer.EXE Token: SeShutdownPrivilege 1376 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE 1376 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exepid process 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1376 Explorer.EXE -
Suspicious use of WriteProcessMemory 20 IoCs
Processes:
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exef01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exeExplorer.EXEdescription pid process target process PID 1432 wrote to memory of 1400 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 1432 wrote to memory of 1400 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 1432 wrote to memory of 1400 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 1432 wrote to memory of 1400 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 1432 wrote to memory of 1400 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 1432 wrote to memory of 1400 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 1432 wrote to memory of 1400 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 1432 wrote to memory of 1400 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 1432 wrote to memory of 1400 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 1432 wrote to memory of 1400 1432 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 1400 wrote to memory of 2036 1400 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe cmd.exe PID 1400 wrote to memory of 2036 1400 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe cmd.exe PID 1400 wrote to memory of 2036 1400 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe cmd.exe PID 1400 wrote to memory of 2036 1400 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe cmd.exe PID 1400 wrote to memory of 1376 1400 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe Explorer.EXE PID 1376 wrote to memory of 1216 1376 Explorer.EXE taskhost.exe PID 1376 wrote to memory of 1216 1376 Explorer.EXE taskhost.exe PID 1376 wrote to memory of 1296 1376 Explorer.EXE Dwm.exe PID 1376 wrote to memory of 2036 1376 Explorer.EXE cmd.exe PID 1376 wrote to memory of 2028 1376 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe"C:\Users\Admin\AppData\Local\Temp\f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exeC:\Users\Admin\AppData\Local\Temp\f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\ms67357.bat"4⤵
- Deletes itself
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "-1501962695182194761788215754314713125137567788301581250091257845821-1936345366"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms67357.batFilesize
200B
MD5b64b4ccd76958911afe5c1f60af32f6d
SHA12942718fb002947dddc1d4937df7b310383e9a9e
SHA256b9788df884e79814deae22c90911bfc4b561f3f2b43816c294d63949a4df0674
SHA51271f8f00d48168d5f94bfcbad2aecdaabc710438f1912d06ec7ff863036c54ceb9dcde4f1485219eaed80c7fc3bee806254f34e9735b9b44f8fa47ce862908ce7
-
memory/1216-92-0x00000000002B0000-0x00000000002C7000-memory.dmpFilesize
92KB
-
memory/1216-90-0x00000000002D0000-0x00000000002E7000-memory.dmpFilesize
92KB
-
memory/1216-86-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1216-83-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1296-91-0x0000000001BD0000-0x0000000001BE7000-memory.dmpFilesize
92KB
-
memory/1296-85-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1376-72-0x0000000002720000-0x0000000002737000-memory.dmpFilesize
92KB
-
memory/1376-93-0x0000000002720000-0x0000000002737000-memory.dmpFilesize
92KB
-
memory/1376-89-0x0000000002720000-0x0000000002737000-memory.dmpFilesize
92KB
-
memory/1376-75-0x00000000374A0000-0x00000000374B0000-memory.dmpFilesize
64KB
-
memory/1400-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1400-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1400-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1400-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1400-64-0x00000000004010C0-mapping.dmp
-
memory/1400-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1400-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1400-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1400-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1432-54-0x0000000075FB1000-0x0000000075FB3000-memory.dmpFilesize
8KB
-
memory/1432-65-0x00000000001D0000-0x00000000001D4000-memory.dmpFilesize
16KB
-
memory/2036-71-0x0000000000000000-mapping.dmp
-
memory/2036-82-0x0000000000110000-0x0000000000124000-memory.dmpFilesize
80KB