Analysis
-
max time kernel
153s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 04:23
Static task
static1
Behavioral task
behavioral1
Sample
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe
Resource
win10v2004-20220812-en
General
-
Target
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe
-
Size
196KB
-
MD5
fbc0d92f2f004428671631c74da80b4a
-
SHA1
f3f2933db39c9368885854fe522105414d73bc97
-
SHA256
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176
-
SHA512
114c95ba4fc8823dfa9fbfa48eea0a8fc82edbafded6d29e2dbf4e77fd1328150db1541d6bc75df218a0e1ed70c5068930ccdc73dd95dba153151174178c4268
-
SSDEEP
3072:9udusODvGZVHhXwdrkr3k17awTtgXOahnEhHP+2lqKA8ZQ2VwDNNK8N58Tbntd+z:59+phXUHTS/hEhHW8G8ZpGhNzSuz
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\metlqowx.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\metlqowx.exe\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exedescription pid process target process PID 4948 set thread context of 4408 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 1056 3280 WerFault.exe DllHost.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exef01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exeExplorer.EXEpid process 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe 4408 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe 4408 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe 2520 Explorer.EXE 2520 Explorer.EXE 2520 Explorer.EXE 2520 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 2520 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exeExplorer.EXERuntimeBroker.exedescription pid process Token: SeDebugPrivilege 4408 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe Token: SeDebugPrivilege 2520 Explorer.EXE Token: SeShutdownPrivilege 2520 Explorer.EXE Token: SeCreatePagefilePrivilege 2520 Explorer.EXE Token: SeShutdownPrivilege 3516 RuntimeBroker.exe Token: SeShutdownPrivilege 3516 RuntimeBroker.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exepid process 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe -
Suspicious use of WriteProcessMemory 27 IoCs
Processes:
f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exef01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exeExplorer.EXEdescription pid process target process PID 4948 wrote to memory of 4408 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 4948 wrote to memory of 4408 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 4948 wrote to memory of 4408 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 4948 wrote to memory of 4408 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 4948 wrote to memory of 4408 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 4948 wrote to memory of 4408 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 4948 wrote to memory of 4408 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 4948 wrote to memory of 4408 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 4948 wrote to memory of 4408 4948 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 4408 wrote to memory of 5084 4408 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe cmd.exe PID 4408 wrote to memory of 5084 4408 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe cmd.exe PID 4408 wrote to memory of 5084 4408 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe cmd.exe PID 4408 wrote to memory of 2520 4408 f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe Explorer.EXE PID 2520 wrote to memory of 2348 2520 Explorer.EXE sihost.exe PID 2520 wrote to memory of 2388 2520 Explorer.EXE svchost.exe PID 2520 wrote to memory of 2492 2520 Explorer.EXE taskhostw.exe PID 2520 wrote to memory of 3080 2520 Explorer.EXE svchost.exe PID 2520 wrote to memory of 3280 2520 Explorer.EXE DllHost.exe PID 2520 wrote to memory of 3376 2520 Explorer.EXE StartMenuExperienceHost.exe PID 2520 wrote to memory of 3516 2520 Explorer.EXE RuntimeBroker.exe PID 2520 wrote to memory of 3596 2520 Explorer.EXE SearchApp.exe PID 2520 wrote to memory of 3808 2520 Explorer.EXE RuntimeBroker.exe PID 2520 wrote to memory of 4736 2520 Explorer.EXE RuntimeBroker.exe PID 2520 wrote to memory of 456 2520 Explorer.EXE backgroundTaskHost.exe PID 2520 wrote to memory of 4408 2520 Explorer.EXE f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe PID 2520 wrote to memory of 5084 2520 Explorer.EXE cmd.exe PID 2520 wrote to memory of 1480 2520 Explorer.EXE Conhost.exe
Processes
-
C:\Windows\system32\sihost.exesihost.exe1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\backgroundTaskHost.exe"C:\Windows\system32\backgroundTaskHost.exe" -ServerName:App.AppX53ypgrj20bgndg05hj3tc7z654myszwp.mca1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe"C:\Windows\SystemApps\Microsoft.Windows.Search_cw5n1h2txyewy\SearchApp.exe" -ServerName:CortanaUI.AppX8z9r6jm96hw4bsbneegw0kyxx296wr9t.mca1⤵
-
C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe"C:\Windows\SystemApps\Microsoft.Windows.StartMenuExperienceHost_cw5n1h2txyewy\StartMenuExperienceHost.exe" -ServerName:App.AppXywbrabmsek0gm3tkwpr5kwzbs55tkqay.mca1⤵
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 3280 -s 9842⤵
- Program crash
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k ClipboardSvcGroup -p -s cbdhsvc1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe"C:\Users\Admin\AppData\Local\Temp\f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exeC:\Users\Admin\AppData\Local\Temp\f01e419980f703e05d31efdca2d58ebda0ca38cafd22900b5221bc89bc2a7176.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS8709~1.BAT"4⤵
-
C:\Windows\System32\Conhost.exe\??\C:\Windows\system32\conhost.exe 0xffffffff -ForceV15⤵
-
C:\Windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -pss -s 460 -p 3280 -ip 32801⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms8709382.batFilesize
201B
MD5b4e4e9a9937528e5e65b57fcb0967343
SHA177750cc71df701c0b5a0edfe2596e3c03080c288
SHA256fc9368f2a1634fabac9819ab0681c82670b0f60047e9a97b6d43f26568505d11
SHA51294dfb6a70e0ee0906bea2224edbdade5d5a945fcb00315d12c9820e80af548c68c3f7be73eb1616a40839555f3ebbd313b1ac850a5dc3ec5cfe7deca5883ad27
-
memory/1480-158-0x000001CA3D380000-0x000001CA3D397000-memory.dmpFilesize
92KB
-
memory/1480-147-0x00007FF80E8D0000-0x00007FF80E8E0000-memory.dmpFilesize
64KB
-
memory/2348-140-0x00007FF80E8D0000-0x00007FF80E8E0000-memory.dmpFilesize
64KB
-
memory/2348-149-0x0000028618B30000-0x0000028618B47000-memory.dmpFilesize
92KB
-
memory/2388-151-0x000002844A900000-0x000002844A917000-memory.dmpFilesize
92KB
-
memory/2388-141-0x00007FF80E8D0000-0x00007FF80E8E0000-memory.dmpFilesize
64KB
-
memory/2492-143-0x00007FF80E8D0000-0x00007FF80E8E0000-memory.dmpFilesize
64KB
-
memory/2492-152-0x0000022B74A70000-0x0000022B74A87000-memory.dmpFilesize
92KB
-
memory/2520-162-0x0000000001060000-0x0000000001077000-memory.dmpFilesize
92KB
-
memory/2520-138-0x00007FF80E8D0000-0x00007FF80E8E0000-memory.dmpFilesize
64KB
-
memory/2520-150-0x0000000001060000-0x0000000001077000-memory.dmpFilesize
92KB
-
memory/3080-153-0x0000022A7BD40000-0x0000022A7BD57000-memory.dmpFilesize
92KB
-
memory/3080-142-0x00007FF80E8D0000-0x00007FF80E8E0000-memory.dmpFilesize
64KB
-
memory/3376-144-0x00007FF80E8D0000-0x00007FF80E8E0000-memory.dmpFilesize
64KB
-
memory/3376-154-0x0000025C551A0000-0x0000025C551B7000-memory.dmpFilesize
92KB
-
memory/3516-145-0x00007FF80E8D0000-0x00007FF80E8E0000-memory.dmpFilesize
64KB
-
memory/3516-155-0x000001A750800000-0x000001A750817000-memory.dmpFilesize
92KB
-
memory/3808-157-0x0000020EA0130000-0x0000020EA0147000-memory.dmpFilesize
92KB
-
memory/3808-148-0x00007FF80E8D0000-0x00007FF80E8E0000-memory.dmpFilesize
64KB
-
memory/4408-139-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4408-133-0x0000000000000000-mapping.dmp
-
memory/4408-136-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4408-134-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/4736-146-0x00007FF80E8D0000-0x00007FF80E8E0000-memory.dmpFilesize
64KB
-
memory/4736-156-0x00000267BE740000-0x00000267BE757000-memory.dmpFilesize
92KB
-
memory/4948-132-0x0000000000CA0000-0x0000000000CA4000-memory.dmpFilesize
16KB
-
memory/5084-159-0x0000000037250000-0x0000000037260000-memory.dmpFilesize
64KB
-
memory/5084-161-0x00000000001D0000-0x00000000001E4000-memory.dmpFilesize
80KB
-
memory/5084-137-0x0000000000000000-mapping.dmp