Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 23:14
Static task
static1
Behavioral task
behavioral1
Sample
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
Resource
win10v2004-20220812-en
General
-
Target
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe
-
Size
176KB
-
MD5
5095f22cbdd7c59303fb7d670c97afa5
-
SHA1
35712036e76c5215b512f9ddb73321617387a98c
-
SHA256
79e4ffae8c0d0abd80d090d5f3465855b25955509e78d0ced3eab4cfa6d43015
-
SHA512
9c4815c773a1b57c1178056fec3063894869b51af02cca52baf94a8ee1644d90a2b7444951979f15ecf90f718ad920353cf21927e754158580e479ea5106c0fc
-
SSDEEP
3072:5KzHNmI+9MEJRuOmz1C+cSQStd3jUQdW6OTHeOO16ogZrssN6wc+ga0Mhze:5qHByNJGBC+Cqz14TE6dZr5PQ
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
cmd.exepid process 1204 cmd.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
Explorer.EXEdescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\usrbdvpp.exe = "\"C:\\Users\\Admin\\AppData\\Roaming\\Identities\\usrbdvpp.exe\"" Explorer.EXE Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run Explorer.EXE -
Suspicious use of SetThreadContext 1 IoCs
Processes:
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exedescription pid process target process PID 2032 set thread context of 944 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe -
Suspicious behavior: EnumeratesProcesses 17 IoCs
Processes:
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exeRG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exeExplorer.EXEpid process 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 944 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 944 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 1368 Explorer.EXE 1368 Explorer.EXE 1368 Explorer.EXE 1368 Explorer.EXE 1368 Explorer.EXE 1368 Explorer.EXE 1368 Explorer.EXE 1368 Explorer.EXE 1368 Explorer.EXE 1368 Explorer.EXE 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exeExplorer.EXEdescription pid process Token: SeDebugPrivilege 944 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe Token: SeDebugPrivilege 1368 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE 1368 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exepid process 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
Explorer.EXEpid process 1368 Explorer.EXE -
Suspicious use of WriteProcessMemory 19 IoCs
Processes:
RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exeRG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exeExplorer.EXEdescription pid process target process PID 2032 wrote to memory of 944 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe PID 2032 wrote to memory of 944 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe PID 2032 wrote to memory of 944 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe PID 2032 wrote to memory of 944 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe PID 2032 wrote to memory of 944 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe PID 2032 wrote to memory of 944 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe PID 2032 wrote to memory of 944 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe PID 2032 wrote to memory of 944 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe PID 2032 wrote to memory of 944 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe PID 2032 wrote to memory of 944 2032 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe PID 944 wrote to memory of 1204 944 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe cmd.exe PID 944 wrote to memory of 1204 944 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe cmd.exe PID 944 wrote to memory of 1204 944 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe cmd.exe PID 944 wrote to memory of 1204 944 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe cmd.exe PID 944 wrote to memory of 1368 944 RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe Explorer.EXE PID 1368 wrote to memory of 1232 1368 Explorer.EXE taskhost.exe PID 1368 wrote to memory of 1328 1368 Explorer.EXE Dwm.exe PID 1368 wrote to memory of 1204 1368 Explorer.EXE cmd.exe PID 1368 wrote to memory of 320 1368 Explorer.EXE conhost.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1368 -
C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe"C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2032 -
C:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exeC:\Users\Admin\AppData\Local\Temp\RG928200002_2014_november_00000329320.023042490280.0324980000038-0000006.exe3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:944 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c "C:\Users\Admin\AppData\Roaming\MS6374~1.BAT"4⤵
- Deletes itself
PID:1204
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1328
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1232
-
C:\Windows\system32\conhost.exe\??\C:\Windows\system32\conhost.exe "95036919215964192354743884261089658069-1474475517914217601045104048-730833611"1⤵PID:320
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\ms6374069.batFilesize
201B
MD51bbc6555429d4c9e7b50b45fd47d1ff4
SHA12f5aa5a0e44ff71811d46588924dc3f737edcd36
SHA2566db0039bd2cc78673123049b4e4dba494437187044d38e4bb324132a9180d6bf
SHA51242ff47b51b389d3c33a8c9854b233902728cb73fef05b2c6517ba50e8509107a273d275e1e6c596740e3a86ceb53043d2f8c0076ceec5a51c3a3ea0d0c08ad3a
-
memory/320-86-0x0000000037AB0000-0x0000000037AC0000-memory.dmpFilesize
64KB
-
memory/320-88-0x00000000000A0000-0x00000000000B7000-memory.dmpFilesize
92KB
-
memory/944-63-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/944-60-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/944-62-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/944-55-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/944-64-0x00000000004010C0-mapping.dmp
-
memory/944-67-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/944-56-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/944-58-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/944-74-0x0000000000400000-0x0000000000412000-memory.dmpFilesize
72KB
-
memory/1204-71-0x0000000000000000-mapping.dmp
-
memory/1204-81-0x0000000000250000-0x0000000000264000-memory.dmpFilesize
80KB
-
memory/1232-80-0x0000000037AB0000-0x0000000037AC0000-memory.dmpFilesize
64KB
-
memory/1232-89-0x0000000000490000-0x00000000004A7000-memory.dmpFilesize
92KB
-
memory/1328-83-0x0000000037AB0000-0x0000000037AC0000-memory.dmpFilesize
64KB
-
memory/1328-91-0x00000000002A0000-0x00000000002B7000-memory.dmpFilesize
92KB
-
memory/1368-75-0x0000000037AB0000-0x0000000037AC0000-memory.dmpFilesize
64KB
-
memory/1368-72-0x0000000002570000-0x0000000002587000-memory.dmpFilesize
92KB
-
memory/1368-90-0x0000000002570000-0x0000000002587000-memory.dmpFilesize
92KB
-
memory/1368-92-0x0000000002570000-0x0000000002587000-memory.dmpFilesize
92KB
-
memory/1368-93-0x000007FEF6DD0000-0x000007FEF6F13000-memory.dmpFilesize
1.3MB
-
memory/1368-94-0x000007FF523A0000-0x000007FF523AA000-memory.dmpFilesize
40KB
-
memory/2032-66-0x0000000000350000-0x0000000000354000-memory.dmpFilesize
16KB
-
memory/2032-54-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB