Overview
overview
10Static
static
8©ɱ...08.exe
windows7-x64
1©ɱ...08.exe
windows10-2004-x64
1©ɱ...17.exe
windows7-x64
5©ɱ...17.exe
windows10-2004-x64
3©ɱ...20.exe
windows7-x64
3©ɱ...20.exe
windows10-2004-x64
1©ɱ...22.exe
windows7-x64
6©ɱ...22.exe
windows10-2004-x64
6©ɱ...40.exe
windows7-x64
5©ɱ...40.exe
windows10-2004-x64
5©ɱ...46.exe
windows7-x64
3©ɱ...46.exe
windows10-2004-x64
4©ɱ...53.exe
windows7-x64
6©ɱ...53.exe
windows10-2004-x64
6©ɱ...58.exe
windows7-x64
1©ɱ...58.exe
windows10-2004-x64
1©ɱ...77.exe
windows7-x64
3©ɱ...77.exe
windows10-2004-x64
3©ɱ...80.exe
windows7-x64
10©ɱ...80.exe
windows10-2004-x64
10©ɱ...83.exe
windows7-x64
8©ɱ...83.exe
windows10-2004-x64
8©ɱ...89.exe
windows7-x64
10©ɱ...89.exe
windows10-2004-x64
6©ɱ...93.exe
windows7-x64
1©ɱ...93.exe
windows10-2004-x64
1©ɱ...95.exe
windows7-x64
3©ɱ...95.exe
windows10-2004-x64
4©ɱ...98.exe
windows7-x64
10©ɱ...98.exe
windows10-2004-x64
6Analysis
-
max time kernel
150s -
max time network
44s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 09:08
Behavioral task
behavioral1
Sample
©ɱ/008.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
©ɱ/008.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral3
Sample
©ɱ/017.exe
Resource
win7-20221111-en
Behavioral task
behavioral4
Sample
©ɱ/017.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral5
Sample
©ɱ/020.exe
Resource
win7-20221111-en
Behavioral task
behavioral6
Sample
©ɱ/020.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral7
Sample
©ɱ/022.exe
Resource
win7-20220812-en
Behavioral task
behavioral8
Sample
©ɱ/022.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral9
Sample
©ɱ/040.exe
Resource
win7-20221111-en
Behavioral task
behavioral10
Sample
©ɱ/040.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral11
Sample
©ɱ/046.exe
Resource
win7-20221111-en
Behavioral task
behavioral12
Sample
©ɱ/046.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral13
Sample
©ɱ/053.exe
Resource
win7-20221111-en
Behavioral task
behavioral14
Sample
©ɱ/053.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral15
Sample
©ɱ/058.exe
Resource
win7-20220901-en
Behavioral task
behavioral16
Sample
©ɱ/058.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral17
Sample
©ɱ/077.exe
Resource
win7-20220812-en
Behavioral task
behavioral18
Sample
©ɱ/077.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral19
Sample
©ɱ/080.exe
Resource
win7-20220812-en
Behavioral task
behavioral20
Sample
©ɱ/080.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral21
Sample
©ɱ/083.exe
Resource
win7-20220901-en
Behavioral task
behavioral22
Sample
©ɱ/083.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral23
Sample
©ɱ/089.exe
Resource
win7-20220812-en
Behavioral task
behavioral24
Sample
©ɱ/089.exe
Resource
win10v2004-20221111-en
Behavioral task
behavioral25
Sample
©ɱ/093.exe
Resource
win7-20220812-en
Behavioral task
behavioral26
Sample
©ɱ/093.exe
Resource
win10v2004-20220812-en
Behavioral task
behavioral27
Sample
©ɱ/095.exe
Resource
win7-20221111-en
Behavioral task
behavioral28
Sample
©ɱ/095.exe
Resource
win10v2004-20220901-en
Behavioral task
behavioral29
Sample
©ɱ/098.exe
Resource
win7-20220901-en
Behavioral task
behavioral30
Sample
©ɱ/098.exe
Resource
win10v2004-20221111-en
General
-
Target
©ɱ/089.exe
-
Size
92KB
-
MD5
51c7d3f4106b5557f9bdfaab4267be80
-
SHA1
b5fc281eb69f928836b87a368c75a463d0e98c32
-
SHA256
9e8daaef763f7ba248c473550d75ec675fa789ed61ac8796dd5357d928fcccad
-
SHA512
c800da51283853f39c1a2498e9d6395c38afe81dedfd0fdb25e33cba8ef50b4897e084924ae7b6a2f864c4cb4456c470c372e01f2333d80336ac3fa9491a35c8
-
SSDEEP
768:PpOOOgbxjhv+ZddsrCnDXn2tPIlnXOREbGnFkHjbGyrIMWG5ErjS:PpOOOiGZHkCDG1SmF2jbxWGq6
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\ProgramData\\DisplaySwitch.exe" svchost.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DisplaySwitch = "\"C:\\ProgramData\\DisplaySwitch.exe\"" svchost.exe -
Processes:
089.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 089.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
089.exepid process 1488 089.exe 1488 089.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
089.exedescription pid process Token: SeDebugPrivilege 1488 089.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
089.exepid process 1488 089.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
089.exedescription pid process target process PID 1488 wrote to memory of 1076 1488 089.exe svchost.exe PID 1488 wrote to memory of 1076 1488 089.exe svchost.exe PID 1488 wrote to memory of 1076 1488 089.exe svchost.exe PID 1488 wrote to memory of 1076 1488 089.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\©ɱ\089.exe"C:\Users\Admin\AppData\Local\Temp\©ɱ\089.exe"1⤵
- Checks whether UAC is enabled
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Modifies WinLogon for persistence
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1076-57-0x0000000000000000-mapping.dmp
-
memory/1076-61-0x0000000000080000-0x0000000000087000-memory.dmpFilesize
28KB
-
memory/1076-60-0x0000000000140000-0x0000000000148000-memory.dmpFilesize
32KB
-
memory/1076-62-0x0000000000080000-0x0000000000087000-memory.dmpFilesize
28KB
-
memory/1488-54-0x0000000000230000-0x0000000000237000-memory.dmpFilesize
28KB
-
memory/1488-55-0x0000000000400000-0x000000000041B000-memory.dmpFilesize
108KB
-
memory/1488-56-0x0000000076681000-0x0000000076683000-memory.dmpFilesize
8KB
-
memory/1488-58-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB