Analysis
-
max time kernel
220s -
max time network
295s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 21:34
Static task
static1
Behavioral task
behavioral1
Sample
ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe
Resource
win10v2004-20221111-en
General
-
Target
ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe
-
Size
148KB
-
MD5
1dbeee8212ba715ab6c63937976c9404
-
SHA1
b0c8f9326f575363275be2c7a1bab7b884e4e028
-
SHA256
ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019
-
SHA512
93dac0afac2b95bbad99368811c2aea1ca6ef50a34f7bb70a183c70643f56fdf1fbbf1c13d21a9dbfc2f393c8e1e150cb86161f0cd30e66969887e7b5891897d
-
SSDEEP
3072:utoxi/iMEn+t1u42T2P4JE15dydO5b6Q0lel2qX:umi/iMDtQRT2PvpWwMqX
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run EXPLORER.exe Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\Run\A6F788C8 = "C:\\Users\\Admin\\AppData\\Roaming\\A6F788C8\\bin.exe" EXPLORER.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 600 set thread context of 752 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 28 -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe 656 EXPLORER.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1212 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 600 wrote to memory of 752 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 28 PID 600 wrote to memory of 752 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 28 PID 600 wrote to memory of 752 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 28 PID 600 wrote to memory of 752 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 28 PID 600 wrote to memory of 752 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 28 PID 600 wrote to memory of 752 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 28 PID 600 wrote to memory of 752 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 28 PID 600 wrote to memory of 752 600 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 28 PID 752 wrote to memory of 656 752 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 29 PID 752 wrote to memory of 656 752 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 29 PID 752 wrote to memory of 656 752 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 29 PID 752 wrote to memory of 656 752 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 29 PID 752 wrote to memory of 656 752 ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe 29 PID 656 wrote to memory of 1104 656 EXPLORER.exe 9 PID 656 wrote to memory of 1180 656 EXPLORER.exe 17 PID 656 wrote to memory of 1212 656 EXPLORER.exe 16
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1104
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe"C:\Users\Admin\AppData\Local\Temp\ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:600 -
C:\Users\Admin\AppData\Local\Temp\ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe"C:\Users\Admin\AppData\Local\Temp\ccd68df63f0b4cd030fc9d1617ba4c0af36926b626996565503bfef2e9488019.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:752 -
C:\Windows\SysWOW64\EXPLORER.exeEXPLORER4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:656
-
-
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1180