Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
25-11-2022 12:38
Static task
static1
Behavioral task
behavioral1
Sample
cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe
Resource
win10v2004-20221111-en
General
-
Target
cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe
-
Size
340KB
-
MD5
f761c4398b110bea9277ed748dde7b6b
-
SHA1
8499723f053e858fd5b137ef2b37f9e5246a2541
-
SHA256
cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de
-
SHA512
c3f0c71d2e57464a5a026717b5b722aef00254da7fb1970dad012baa5b87fb288054d2999997e962a1c29c06c8f191c83b3364ef1b30005e7bf37c345e9ae73a
-
SSDEEP
3072:vWj88gIutEWtCChxuGPb/jCFPtGZLWqFkgoi5:v98LGpllT/jCPGZLPF+i
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1160 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usredit32.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\usredit32.exe" Explorer.EXE -
NTFS ADS 1 IoCs
Processes:
cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\usredit32.exe:Zone.Identifier cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
Processes:
cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exeExplorer.EXEpid process 1720 cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe 1720 cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE 1224 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1224 Explorer.EXE -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exeExplorer.EXEdescription pid process target process PID 1720 wrote to memory of 1160 1720 cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe cmd.exe PID 1720 wrote to memory of 1160 1720 cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe cmd.exe PID 1720 wrote to memory of 1160 1720 cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe cmd.exe PID 1720 wrote to memory of 1160 1720 cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe cmd.exe PID 1720 wrote to memory of 1224 1720 cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe Explorer.EXE PID 1720 wrote to memory of 1224 1720 cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe Explorer.EXE PID 1224 wrote to memory of 1128 1224 Explorer.EXE taskhost.exe PID 1224 wrote to memory of 1128 1224 Explorer.EXE taskhost.exe PID 1224 wrote to memory of 1188 1224 Explorer.EXE Dwm.exe PID 1224 wrote to memory of 1188 1224 Explorer.EXE Dwm.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe"C:\Users\Admin\AppData\Local\Temp\cd7e14edb9e0dadebadccf40c077382122450db7e81e8790f74f91800d44c8de.exe"2⤵
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\67357.bat"3⤵
- Deletes itself
PID:1160
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1188
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\67357.batFilesize
198B
MD57d71e306d71f2612fc5631946df61347
SHA12a6b2a71d990c7e7c9a1dbbd150e2bf6a3b12a8f
SHA2564ce433c603bf8f1e413968d3b45dc554467b92c790236b22bc7043bf48d7ec9b
SHA512fad2ce6f62860b0945d97fc484d9ef7de44a7d164c93b948eff394ace900c9a3d323ea98a73abb19780f4da44d06f772dd54351cbc2cfa4006bb16ca56d44047
-
memory/1128-70-0x0000000037620000-0x0000000037630000-memory.dmpFilesize
64KB
-
memory/1128-74-0x0000000001B90000-0x0000000001BAD000-memory.dmpFilesize
116KB
-
memory/1160-55-0x0000000000000000-mapping.dmp
-
memory/1188-75-0x0000000000120000-0x000000000013D000-memory.dmpFilesize
116KB
-
memory/1188-73-0x0000000037620000-0x0000000037630000-memory.dmpFilesize
64KB
-
memory/1224-58-0x0000000002A20000-0x0000000002A3D000-memory.dmpFilesize
116KB
-
memory/1224-63-0x0000000037620000-0x0000000037630000-memory.dmpFilesize
64KB
-
memory/1224-56-0x0000000002A20000-0x0000000002A3D000-memory.dmpFilesize
116KB
-
memory/1224-76-0x0000000002A20000-0x0000000002A3D000-memory.dmpFilesize
116KB
-
memory/1720-62-0x0000000000E90000-0x0000000000EEA000-memory.dmpFilesize
360KB
-
memory/1720-61-0x0000000000120000-0x000000000012E000-memory.dmpFilesize
56KB
-
memory/1720-54-0x00000000765B1000-0x00000000765B3000-memory.dmpFilesize
8KB