Analysis
-
max time kernel
132s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
25-11-2022 07:31
Static task
static1
Behavioral task
behavioral1
Sample
892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe
Resource
win10v2004-20220901-en
General
-
Target
892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe
-
Size
3.2MB
-
MD5
b7a3810e62d2154b356267f64746d0cb
-
SHA1
f80e3f795beb0003c38d5dfc0544f0a677f01c6e
-
SHA256
892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5
-
SHA512
11594d377ee238d365c4250842ed51750abd8369e592bf34f0ec1b166f273f68733716b6f9d0f494d6bf27205dbf1b38a46fb833078383862c30649d8f1c989d
-
SSDEEP
98304:HityitqjVG2Dj8eGp3FjnANhDB8bdeZZu26mSUstHJii:HTFj8jp3FjAvOe4fmcpj
Malware Config
Signatures
-
Processes:
reg.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" reg.exe -
Executes dropped EXE 1 IoCs
Processes:
kill.exepid process 2320 kill.exe -
Processes:
resource yara_rule C:\kill.exe upx \??\c:\kill.exe upx behavioral2/memory/2320-136-0x0000000000400000-0x00000000006B4000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exedescription ioc process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchosts = "C:\\Windows\\System32\\svchosts.exe" 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\System32\\svchosts.exe" 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe -
Drops file in System32 directory 2 IoCs
Processes:
892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exedescription ioc process File created C:\Windows\SysWOW64\svchosts.exe 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe File opened for modification C:\Windows\SysWOW64\svchosts.exe 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe -
Modifies registry key 1 TTPs 1 IoCs
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exepid process 4252 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
kill.exe892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exepid process 2320 kill.exe 2320 kill.exe 4252 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe 4252 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.execmd.exedescription pid process target process PID 4252 wrote to memory of 2320 4252 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe kill.exe PID 4252 wrote to memory of 2320 4252 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe kill.exe PID 4252 wrote to memory of 2320 4252 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe kill.exe PID 4252 wrote to memory of 212 4252 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe cmd.exe PID 4252 wrote to memory of 212 4252 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe cmd.exe PID 4252 wrote to memory of 212 4252 892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe cmd.exe PID 212 wrote to memory of 916 212 cmd.exe reg.exe PID 212 wrote to memory of 916 212 cmd.exe reg.exe PID 212 wrote to memory of 916 212 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe"C:\Users\Admin\AppData\Local\Temp\892109f5a0998026fd22f457a8cf84f9e0585e3de8e01b9348dc379938b258b5.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4252 -
\??\c:\kill.exec:\kill.exe /nogui c:\kill.txt2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:2320 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\System32\cmd.exe /k %windir%\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f2⤵
- Suspicious use of WriteProcessMemory
PID:212 -
C:\Windows\SysWOW64\reg.exeC:\Windows\System32\reg.exe ADD HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System /v EnableLUA /t REG_DWORD /d 0 /f3⤵
- UAC bypass
- Modifies registry key
PID:916
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\kill.exeFilesize
714KB
MD530f3680e007d924960fd65524de36601
SHA123f1e67e28052188432d2031335a79cb5ae72a8f
SHA2566485271fe48f7be4cb49735c60fa4cf2ff52f235e2b24bfba22df6ea75fda1d7
SHA51233323b60353430962ef0e07dd166625ae8cb1d2080f75859d35cf0c807d146ccd7272feef37ebbe8ce77f988658ef0dee6602f9b1bcf429cd0c1898862b5091a
-
\??\c:\kill.exeFilesize
714KB
MD530f3680e007d924960fd65524de36601
SHA123f1e67e28052188432d2031335a79cb5ae72a8f
SHA2566485271fe48f7be4cb49735c60fa4cf2ff52f235e2b24bfba22df6ea75fda1d7
SHA51233323b60353430962ef0e07dd166625ae8cb1d2080f75859d35cf0c807d146ccd7272feef37ebbe8ce77f988658ef0dee6602f9b1bcf429cd0c1898862b5091a
-
memory/212-137-0x0000000000000000-mapping.dmp
-
memory/916-138-0x0000000000000000-mapping.dmp
-
memory/2320-133-0x0000000000000000-mapping.dmp
-
memory/2320-136-0x0000000000400000-0x00000000006B4000-memory.dmpFilesize
2.7MB
-
memory/4252-132-0x0000000000400000-0x0000000001FB4000-memory.dmpFilesize
27.7MB
-
memory/4252-139-0x0000000000400000-0x0000000001FB4000-memory.dmpFilesize
27.7MB