Analysis
-
max time kernel
151s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 23:16
Static task
static1
Behavioral task
behavioral1
Sample
a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe
-
Size
336KB
-
MD5
ec4d618512c10e518cbbcc425e54e612
-
SHA1
a841f69420290e7f1b4813f4cd141e9a59a73a53
-
SHA256
a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926
-
SHA512
526a529445e18e8b9c3d8a55c49c88867249a127a2ebaf75af543f4aaa9ede23888b89bc89adbc5c7160208c66c9bec0b8922f181a750c2691e59e88d9db8f92
-
SSDEEP
6144:pp5aU24gcouSCLo/4A9497IkCxxFrFDRymDLOWve1cCAuT/:ppt24gc+CZA94NIJFxDhLve1Am
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{97AFBD4E-67F9-4158-9645-026EEBABD842}\\f5ea51da.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{97AFBD4E-67F9-4158-9645-026EEBABD842}\\f5ea51da.exe" explorer.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1972 set thread context of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe -
Suspicious behavior: MapViewOfSection 26 IoCs
pid Process 1904 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 1904 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe 1628 explorer.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeDebugPrivilege 1628 explorer.exe Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeSystemtimePrivilege 872 Process not Found Token: SeBackupPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeShutdownPrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeUndockPrivilege 872 Process not Found Token: SeManageVolumePrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1224 Process not Found 1224 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1224 Process not Found 1224 Process not Found -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe -
Suspicious use of UnmapMainImage 6 IoCs
pid Process 792 Process not Found 792 Process not Found 792 Process not Found 792 Process not Found 792 Process not Found 792 Process not Found -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 1972 wrote to memory of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 PID 1972 wrote to memory of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 PID 1972 wrote to memory of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 PID 1972 wrote to memory of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 PID 1972 wrote to memory of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 PID 1972 wrote to memory of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 PID 1972 wrote to memory of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 PID 1972 wrote to memory of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 PID 1972 wrote to memory of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 PID 1972 wrote to memory of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 PID 1972 wrote to memory of 1904 1972 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 28 PID 1904 wrote to memory of 1628 1904 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 29 PID 1904 wrote to memory of 1628 1904 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 29 PID 1904 wrote to memory of 1628 1904 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 29 PID 1904 wrote to memory of 1628 1904 a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe 29 PID 384 wrote to memory of 1628 384 Process not Found 29 PID 384 wrote to memory of 1628 384 Process not Found 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe"C:\Users\Admin\AppData\Local\Temp\a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1972 -
C:\Users\Admin\AppData\Local\Temp\a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe"C:\Users\Admin\AppData\Local\Temp\a0166b750e8a6fa96f813879e93593fdaef75ff63fad688e22d8beb4246f3926.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1628
-
-