Analysis
-
max time kernel
25s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 07:54
Static task
static1
Behavioral task
behavioral1
Sample
5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe
Resource
win10v2004-20220812-en
General
-
Target
5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe
-
Size
299KB
-
MD5
3aa75ed47341725056cb995f6bf3a40d
-
SHA1
b504c2450856046fc2e66041c20a65ffce7cac29
-
SHA256
5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880
-
SHA512
00427b10f7572adb953e38e61aed6c0abbbf0e9b988ab65411cc975bad0fd18a49a37621dd229f4437388ca8e992efc79cdf444eae73790e41938570ea0f738b
-
SSDEEP
3072:NU6nXNyVa/Cb5Fr6LF3w41VTg3yHYilStAg0FuNmyDjCdCyADnEtMPpXlx:O4yVaauR3w2VTg3+jlStAOwCRDe+Fb
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "explorer.exe,C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781862338-11816761\\1v7cbv1.exe" 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\2b27b670 = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781862338-11816761\\1v7cbv1.exe" 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe -
Drops desktop.ini file(s) 1 IoCs
Processes:
5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exedescription ioc process File created C:\RECYCLER\S-1-5-21-0243556031-888888379-781862338-11816761\Desktop.ini 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe -
Modifies WinLogon 2 TTPs 1 IoCs
Processes:
5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Taskman = "C:\\RECYCLER\\S-1-5-21-0243556031-888888379-781862338-11816761\\1v7cbv1.exe" 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exedescription pid process target process PID 964 set thread context of 240 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exepid process 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 240 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exedescription pid process target process PID 964 wrote to memory of 240 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe PID 964 wrote to memory of 240 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe PID 964 wrote to memory of 240 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe PID 964 wrote to memory of 240 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe PID 964 wrote to memory of 240 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe PID 964 wrote to memory of 240 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe PID 964 wrote to memory of 240 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe PID 964 wrote to memory of 240 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe PID 964 wrote to memory of 240 964 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe PID 240 wrote to memory of 1268 240 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe Explorer.EXE PID 240 wrote to memory of 1268 240 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe Explorer.EXE PID 240 wrote to memory of 1268 240 5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1268
-
C:\Users\Admin\AppData\Local\Temp\5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe"C:\Users\Admin\AppData\Local\Temp\5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:964 -
C:\Users\Admin\AppData\Local\Temp\5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe"C:\Users\Admin\AppData\Local\Temp\5154aed1c1c8c84c2551daa04b458fecccfbb2b01f90d529191aefb9ae44c880.exe"3⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
- Drops desktop.ini file(s)
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:240
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/240-54-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/240-55-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/240-57-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/240-58-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/240-59-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/240-60-0x0000000000401920-mapping.dmp
-
memory/240-63-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/964-61-0x00000000003A0000-0x00000000003A3000-memory.dmpFilesize
12KB