Analysis
-
max time kernel
119s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 11:08
Static task
static1
Behavioral task
behavioral1
Sample
f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe
Resource
win10v2004-20220812-en
Errors
General
-
Target
f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe
-
Size
1.9MB
-
MD5
ccab2ea95f8895bc7eca9ee67158b661
-
SHA1
bbf463386c061082cdca777fddabfeef82c647b3
-
SHA256
f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe
-
SHA512
93c8c27889aeb91655a17a27ba8ba37d5abf93d8f1c71d526d3bafeb5dd9749a4b05072441872022cc0def6ac1a3696c65b68e12dabf85ab3cda2ee9bda8932b
-
SSDEEP
49152:kEaGqcDaYybXkdlMDoRco9yXfdqhf+P+3vkN3VGES:kfmaTOeU+o9mdqQP+3spS
Malware Config
Signatures
-
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 13 IoCs
Processes:
f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exepid process 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exedescription pid process Token: SeDebugPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: SeIncBasePriorityPrivilege 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe Token: 33 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.execmd.exedescription pid process target process PID 592 wrote to memory of 1928 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe cmd.exe PID 592 wrote to memory of 1928 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe cmd.exe PID 592 wrote to memory of 1928 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe cmd.exe PID 1928 wrote to memory of 2032 1928 cmd.exe bcdedit.exe PID 1928 wrote to memory of 2032 1928 cmd.exe bcdedit.exe PID 1928 wrote to memory of 2032 1928 cmd.exe bcdedit.exe PID 592 wrote to memory of 1760 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe shutdown.exe PID 592 wrote to memory of 1760 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe shutdown.exe PID 592 wrote to memory of 1760 592 f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe"C:\Users\Admin\AppData\Local\Temp\f1cfe9ab11101a9282e43b355614e0e6c929ebed5f6c10c0c1ff61e714e24afe.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:592 -
C:\Windows\system32\cmd.execmd.exe /c bcdedit /set safeboot network2⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\system32\bcdedit.exebcdedit /set safeboot network3⤵
- Modifies boot configuration data using bcdedit
PID:2032 -
C:\Windows\system32\shutdown.exeshutdown -r -t 002⤵PID:1760
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1b41⤵PID:1828
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1444
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1696
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/592-54-0x0000000000F30000-0x0000000000F3A000-memory.dmpFilesize
40KB
-
memory/592-55-0x000000001B0B0000-0x000000001B2B6000-memory.dmpFilesize
2.0MB
-
memory/592-56-0x000000001AE70000-0x000000001B032000-memory.dmpFilesize
1.8MB
-
memory/592-57-0x000000001BA00000-0x000000001BBCC000-memory.dmpFilesize
1.8MB
-
memory/592-58-0x000000001BF20000-0x000000001C13C000-memory.dmpFilesize
2.1MB
-
memory/592-59-0x000000001ACA7000-0x000000001ACC6000-memory.dmpFilesize
124KB
-
memory/592-63-0x000000001ACA7000-0x000000001ACC6000-memory.dmpFilesize
124KB
-
memory/1444-64-0x000007FEFBB51000-0x000007FEFBB53000-memory.dmpFilesize
8KB
-
memory/1760-62-0x0000000000000000-mapping.dmp
-
memory/1928-60-0x0000000000000000-mapping.dmp
-
memory/2032-61-0x0000000000000000-mapping.dmp