Analysis

  • max time kernel
    34s
  • max time network
    43s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    24-11-2022 16:48

General

  • Target

    f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe

  • Size

    73KB

  • MD5

    e36ff18f794ff51c15c08bac37d4c431

  • SHA1

    48361224b386e7ec007f2cdb1f7a55a0dba965ad

  • SHA256

    f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546

  • SHA512

    c1ec260e14b7aaa988c90efaf15b71e88e2fc23781128f08f5a67fd27520d944e9e8aa7c7613fe9c2646d9fd042392ec391de8db869acbd86f1f6d0e63f62291

  • SSDEEP

    1536:8W2zMKzBAxiURheeZzXFMShQKUwlMsWS+lskBW1SVyh+BCtQ:KMSBIiURhNzXFMeUXsWS+lskBW9b

Malware Config

Signatures

  • Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
  • UAC bypass 3 TTPs 1 IoCs
  • Adds policy Run key to start application 2 TTPs 2 IoCs
  • Blocklisted process makes network request 5 IoCs
  • Disables taskbar notifications via registry modification
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious behavior: MapViewOfSection 24 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 6 IoCs
  • Suspicious use of WriteProcessMemory 16 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe
    "C:\Users\Admin\AppData\Local\Temp\f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1608
    • C:\Users\Admin\AppData\Local\Temp\f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe
      "C:\Users\Admin\AppData\Local\Temp\f75901e840bc68a51573de50097f8dfb8e4667cf8dceaf3d632cd2ea7d494546.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1996
      • C:\Windows\SysWOW64\msiexec.exe
        C:\Windows\SysWOW64\msiexec.exe
        3⤵
        • Modifies visiblity of hidden/system files in Explorer
        • UAC bypass
        • Adds policy Run key to start application
        • Blocklisted process makes network request
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious behavior: RenamesItself
        • Suspicious use of AdjustPrivilegeToken
        PID:1472

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1472-66-0x0000000000000000-mapping.dmp

  • memory/1472-71-0x000000007EF90000-0x000000007EF96000-memory.dmp

    Filesize

    24KB

  • memory/1472-70-0x000000007EF90000-0x000000007EF96000-memory.dmp

    Filesize

    24KB

  • memory/1472-69-0x0000000000DA0000-0x0000000000DB4000-memory.dmp

    Filesize

    80KB

  • memory/1608-55-0x00000000744E0000-0x0000000074A8B000-memory.dmp

    Filesize

    5.7MB

  • memory/1608-54-0x0000000075A91000-0x0000000075A93000-memory.dmp

    Filesize

    8KB

  • memory/1608-62-0x0000000000350000-0x0000000000353000-memory.dmp

    Filesize

    12KB

  • memory/1608-61-0x00000000744E0000-0x0000000074A8B000-memory.dmp

    Filesize

    5.7MB

  • memory/1996-57-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1996-65-0x000000007EF90000-0x000000007EF96000-memory.dmp

    Filesize

    24KB

  • memory/1996-63-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1996-68-0x000000007EF90000-0x000000007EF96000-memory.dmp

    Filesize

    24KB

  • memory/1996-60-0x000000000001FBDE-mapping.dmp

  • memory/1996-58-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB

  • memory/1996-56-0x0000000000400000-0x0000000000405000-memory.dmp

    Filesize

    20KB