Analysis

  • max time kernel
    189s
  • max time network
    196s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    25-11-2022 19:39

General

  • Target

    47be7e763ff8a3fdc4d6f0bfbf0eea547f72457ec6ab72cb8c702e7597b6ff42.exe

  • Size

    65KB

  • MD5

    a8a456649ff0c4e3c52fa6cebdfe215a

  • SHA1

    445278f08f8d8624d4bed768aa1c2fc26f15eefa

  • SHA256

    47be7e763ff8a3fdc4d6f0bfbf0eea547f72457ec6ab72cb8c702e7597b6ff42

  • SHA512

    6020a52c02de52bc4dbe3345a9416114275c10e6dd6e8e5cb5f37dcc298a1152591ffa4f17ea20a21be0f3f6fa52aaef1d1771aa485feb1dcaaec094b8a672e8

  • SSDEEP

    1536:wc9nwQYsQtdFwFQ8bjaQobU52FWAltktk6y+v:MQYRdFwqoOzPFWAltktzy+v

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\47be7e763ff8a3fdc4d6f0bfbf0eea547f72457ec6ab72cb8c702e7597b6ff42.exe
    "C:\Users\Admin\AppData\Local\Temp\47be7e763ff8a3fdc4d6f0bfbf0eea547f72457ec6ab72cb8c702e7597b6ff42.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:940
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\47BE7E~1.EXE > nul
      2⤵
      • Deletes itself
      PID:1608
  • C:\Windows\SysWOW64\zgtdcg.exe
    C:\Windows\SysWOW64\zgtdcg.exe
    1⤵
    • Executes dropped EXE
    • Checks processor information in registry
    PID:888

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\SysWOW64\zgtdcg.exe
    Filesize

    65KB

    MD5

    a8a456649ff0c4e3c52fa6cebdfe215a

    SHA1

    445278f08f8d8624d4bed768aa1c2fc26f15eefa

    SHA256

    47be7e763ff8a3fdc4d6f0bfbf0eea547f72457ec6ab72cb8c702e7597b6ff42

    SHA512

    6020a52c02de52bc4dbe3345a9416114275c10e6dd6e8e5cb5f37dcc298a1152591ffa4f17ea20a21be0f3f6fa52aaef1d1771aa485feb1dcaaec094b8a672e8

  • memory/940-54-0x0000000075B61000-0x0000000075B63000-memory.dmp
    Filesize

    8KB

  • memory/1608-57-0x0000000000000000-mapping.dmp