Analysis
-
max time kernel
152s -
max time network
157s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
24-11-2022 20:44
Static task
static1
Behavioral task
behavioral1
Sample
af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe
Resource
win10v2004-20221111-en
General
-
Target
af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe
-
Size
583KB
-
MD5
3ed425ec45a4098df4bb68b8dacfe963
-
SHA1
2b2261e7b9efc30f2d3e7c69fe7011309f478ade
-
SHA256
af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d
-
SHA512
a51f83a98ebd7ce01b6af3f241cc91d9b832c676001eec6e1a5d8958a05d8d393a80a329b91e044f530fe7b5dd7cb3c9c5b223a083110fedf3deea2d7ac35abd
-
SSDEEP
12288:ff3V1zIQ0XoeZCMT7ar16I5/elWQ96y1uKsQk84Bqj6deP7H:ffVKVXozM6xvJK96y1YVcPT
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
Processes:
af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\M-507975836687766499060\winsvc.exe = "C:\\Users\\Admin\\M-507975836687766499060\\winsvc.exe:*:Enabled:Microsoft Windows Update" af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe -
Executes dropped EXE 2 IoCs
Processes:
winsvc.exewinsvc.exepid process 1036 winsvc.exe 1744 winsvc.exe -
Loads dropped DLL 2 IoCs
Processes:
af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exepid process 1768 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe 1768 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\ af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update = "C:\\Users\\Admin\\M-507975836687766499060\\winsvc.exe" af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exewinsvc.exedescription pid process target process PID 1204 set thread context of 1768 1204 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe PID 1036 set thread context of 1744 1036 winsvc.exe winsvc.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exewinsvc.exepid process 1204 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe 1204 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe 1036 winsvc.exe 1036 winsvc.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exeaf63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exewinsvc.exedescription pid process target process PID 1204 wrote to memory of 1768 1204 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe PID 1204 wrote to memory of 1768 1204 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe PID 1204 wrote to memory of 1768 1204 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe PID 1204 wrote to memory of 1768 1204 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe PID 1768 wrote to memory of 1036 1768 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe winsvc.exe PID 1768 wrote to memory of 1036 1768 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe winsvc.exe PID 1768 wrote to memory of 1036 1768 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe winsvc.exe PID 1768 wrote to memory of 1036 1768 af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe winsvc.exe PID 1036 wrote to memory of 1744 1036 winsvc.exe winsvc.exe PID 1036 wrote to memory of 1744 1036 winsvc.exe winsvc.exe PID 1036 wrote to memory of 1744 1036 winsvc.exe winsvc.exe PID 1036 wrote to memory of 1744 1036 winsvc.exe winsvc.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe"C:\Users\Admin\AppData\Local\Temp\af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1204 -
C:\Users\Admin\AppData\Local\Temp\af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe"C:\Users\Admin\AppData\Local\Temp\af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d.exe"2⤵
- Modifies firewall policy service
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1768 -
C:\Users\Admin\M-507975836687766499060\winsvc.exeC:\Users\Admin\M-507975836687766499060\winsvc.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1036 -
C:\Users\Admin\M-507975836687766499060\winsvc.exeC:\Users\Admin\M-507975836687766499060\winsvc.exe4⤵
- Executes dropped EXE
PID:1744
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\M-507975836687766499060\winsvc.exeFilesize
583KB
MD53ed425ec45a4098df4bb68b8dacfe963
SHA12b2261e7b9efc30f2d3e7c69fe7011309f478ade
SHA256af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d
SHA512a51f83a98ebd7ce01b6af3f241cc91d9b832c676001eec6e1a5d8958a05d8d393a80a329b91e044f530fe7b5dd7cb3c9c5b223a083110fedf3deea2d7ac35abd
-
C:\Users\Admin\M-507975836687766499060\winsvc.exeFilesize
583KB
MD53ed425ec45a4098df4bb68b8dacfe963
SHA12b2261e7b9efc30f2d3e7c69fe7011309f478ade
SHA256af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d
SHA512a51f83a98ebd7ce01b6af3f241cc91d9b832c676001eec6e1a5d8958a05d8d393a80a329b91e044f530fe7b5dd7cb3c9c5b223a083110fedf3deea2d7ac35abd
-
C:\Users\Admin\M-507975836687766499060\winsvc.exeFilesize
583KB
MD53ed425ec45a4098df4bb68b8dacfe963
SHA12b2261e7b9efc30f2d3e7c69fe7011309f478ade
SHA256af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d
SHA512a51f83a98ebd7ce01b6af3f241cc91d9b832c676001eec6e1a5d8958a05d8d393a80a329b91e044f530fe7b5dd7cb3c9c5b223a083110fedf3deea2d7ac35abd
-
\Users\Admin\M-507975836687766499060\winsvc.exeFilesize
583KB
MD53ed425ec45a4098df4bb68b8dacfe963
SHA12b2261e7b9efc30f2d3e7c69fe7011309f478ade
SHA256af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d
SHA512a51f83a98ebd7ce01b6af3f241cc91d9b832c676001eec6e1a5d8958a05d8d393a80a329b91e044f530fe7b5dd7cb3c9c5b223a083110fedf3deea2d7ac35abd
-
\Users\Admin\M-507975836687766499060\winsvc.exeFilesize
583KB
MD53ed425ec45a4098df4bb68b8dacfe963
SHA12b2261e7b9efc30f2d3e7c69fe7011309f478ade
SHA256af63cae36e18e2f5aaabaa8e9f31ace039059d4853cf14cae6694099ee513d9d
SHA512a51f83a98ebd7ce01b6af3f241cc91d9b832c676001eec6e1a5d8958a05d8d393a80a329b91e044f530fe7b5dd7cb3c9c5b223a083110fedf3deea2d7ac35abd
-
memory/1036-60-0x0000000000000000-mapping.dmp
-
memory/1204-54-0x0000000074DE1000-0x0000000074DE3000-memory.dmpFilesize
8KB
-
memory/1744-64-0x00000000004074A0-mapping.dmp
-
memory/1744-67-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB
-
memory/1768-55-0x00000000004074A0-mapping.dmp
-
memory/1768-57-0x0000000000400000-0x000000000040F000-memory.dmpFilesize
60KB