Analysis
-
max time kernel
151s -
max time network
196s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:50
Static task
static1
Behavioral task
behavioral1
Sample
5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe
Resource
win10v2004-20221111-en
General
-
Target
5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe
-
Size
354KB
-
MD5
a7cf9123614b02be90d0504275c2c96f
-
SHA1
1d77e1a9ad0d05c4d957d98e7e0b22286eedec6a
-
SHA256
5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac
-
SHA512
dee6370517f8664adb3128b041a8e5aedb75c6cbce863bc1482cc88bb3859419f00fbba97e3857d4099a5a7cb09e6dcb6d0f09aafd05be8e0e54495ca032ff6a
-
SSDEEP
6144:npsA1C8dh8iba3yCvAHEAx9J5JMH6dkAOjEczMcf1kMvVkRIAWA:pJjdkAx9J5JMHHBHzFvqMA
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exenotepad.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Lcatae = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Lcatae.exe" notepad.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exenotepad.exedescription ioc process File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\D: notepad.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\T: svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exedescription pid process target process PID 1780 set thread context of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1320 set thread context of 1244 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exesvchost.exe5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exepid process 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 1268 svchost.exe 1244 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exepid process 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exesvchost.execalc.exenotepad.exedescription pid process Token: SeDebugPrivilege 1244 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe Token: SeDebugPrivilege 1268 svchost.exe Token: SeDebugPrivilege 568 calc.exe Token: SeDebugPrivilege 1800 notepad.exe -
Suspicious use of WriteProcessMemory 43 IoCs
Processes:
5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exesvchost.exe5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exedescription pid process target process PID 1780 wrote to memory of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1780 wrote to memory of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1780 wrote to memory of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1780 wrote to memory of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1780 wrote to memory of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1780 wrote to memory of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1780 wrote to memory of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1780 wrote to memory of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1780 wrote to memory of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1780 wrote to memory of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1780 wrote to memory of 1320 1780 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1320 wrote to memory of 1268 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe svchost.exe PID 1320 wrote to memory of 1268 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe svchost.exe PID 1320 wrote to memory of 1268 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe svchost.exe PID 1320 wrote to memory of 1268 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe svchost.exe PID 1320 wrote to memory of 568 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe calc.exe PID 1320 wrote to memory of 568 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe calc.exe PID 1320 wrote to memory of 568 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe calc.exe PID 1320 wrote to memory of 568 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe calc.exe PID 1320 wrote to memory of 568 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe calc.exe PID 1320 wrote to memory of 568 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe calc.exe PID 1320 wrote to memory of 1268 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe svchost.exe PID 1268 wrote to memory of 1800 1268 svchost.exe notepad.exe PID 1268 wrote to memory of 1800 1268 svchost.exe notepad.exe PID 1268 wrote to memory of 1800 1268 svchost.exe notepad.exe PID 1268 wrote to memory of 1800 1268 svchost.exe notepad.exe PID 1268 wrote to memory of 1800 1268 svchost.exe notepad.exe PID 1320 wrote to memory of 1244 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1320 wrote to memory of 1244 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1320 wrote to memory of 1244 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1320 wrote to memory of 1244 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1320 wrote to memory of 1244 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1320 wrote to memory of 1244 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1320 wrote to memory of 1244 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1320 wrote to memory of 1244 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1320 wrote to memory of 1244 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1320 wrote to memory of 1244 1320 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe PID 1244 wrote to memory of 1268 1244 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe svchost.exe PID 1244 wrote to memory of 1268 1244 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe svchost.exe PID 1244 wrote to memory of 568 1244 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe calc.exe PID 1244 wrote to memory of 568 1244 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe calc.exe PID 1244 wrote to memory of 1800 1244 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe notepad.exe PID 1244 wrote to memory of 1800 1244 5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe"C:\Users\Admin\AppData\Local\Temp\5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1780 -
C:\Users\Admin\AppData\Local\Temp\5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe"C:\Users\Admin\AppData\Local\Temp\5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1320 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1268 -
C:\Windows\SysWOW64\notepad.exe"C:\Windows\SysWOW64\notepad.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
PID:1800 -
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
PID:568 -
C:\Users\Admin\AppData\Local\Temp\5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe"C:\Users\Admin\AppData\Local\Temp\5b17710ae6e37bdd4c03641bf98ec1bf97d847b6c799fdfb350360265a4bbaac.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1244
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/568-92-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/568-117-0x00000000002E0000-0x000000000032E000-memory.dmpFilesize
312KB
-
memory/568-346-0x0000000000318000-0x000000000031A000-memory.dmpFilesize
8KB
-
memory/568-336-0x00000000002E0000-0x000000000032E000-memory.dmpFilesize
312KB
-
memory/568-124-0x00000000002E0000-0x000000000032E000-memory.dmpFilesize
312KB
-
memory/568-113-0x00000000002E0000-0x000000000032E000-memory.dmpFilesize
312KB
-
memory/568-161-0x00000000002E0000-0x000000000032E000-memory.dmpFilesize
312KB
-
memory/568-73-0x0000000000000000-mapping.dmp
-
memory/568-70-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/1244-86-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1244-103-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1244-102-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1244-89-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1244-93-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1244-96-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1244-98-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1244-128-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1244-85-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1244-99-0x0000000000410910-mapping.dmp
-
memory/1268-270-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/1268-74-0x0000000000000000-mapping.dmp
-
memory/1268-129-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/1268-123-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/1268-116-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/1268-111-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/1268-90-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1268-108-0x0000000000230000-0x000000000027E000-memory.dmpFilesize
312KB
-
memory/1320-58-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1320-56-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1320-65-0x00000000004045C0-mapping.dmp
-
memory/1320-64-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1320-60-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1320-88-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1320-55-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1320-63-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1320-61-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/1780-54-0x00000000761E1000-0x00000000761E3000-memory.dmpFilesize
8KB
-
memory/1780-66-0x0000000000220000-0x0000000000234000-memory.dmpFilesize
80KB
-
memory/1800-84-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1800-122-0x00000000001D0000-0x000000000021E000-memory.dmpFilesize
312KB
-
memory/1800-337-0x00000000001D0000-0x000000000021E000-memory.dmpFilesize
312KB
-
memory/1800-94-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1800-162-0x00000000001D0000-0x000000000021E000-memory.dmpFilesize
312KB
-
memory/1800-83-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1800-82-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1800-81-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1800-79-0x0000000000000000-mapping.dmp