Analysis
-
max time kernel
151s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 12:44
Static task
static1
Behavioral task
behavioral1
Sample
2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe
Resource
win10v2004-20221111-en
General
-
Target
2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe
-
Size
165KB
-
MD5
20d875ef318f7fe70895b7ca2d8c73fa
-
SHA1
8368173f6edc826b06f72b2fef0818931f49ba5d
-
SHA256
2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762
-
SHA512
bd8632736cb816bd94fefad125138996dc0ae02f066dff3f498762c55be96c652fbcf6763b46f99c212c578275795fb4b675b4aaf138f0e237c5934ac71e375c
-
SSDEEP
3072:KYmlOJseb6jEfMR5kF/71yiMF44WyUtVU1yOXGB8kFF/df2oFfHgWiI+xR:vueOwqfJxU7iFXG/rdf2oRPy
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1584-56-0x0000000000400000-0x0000000000446000-memory.dmp cryptone behavioral1/memory/376-71-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/376-72-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/376-70-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1452-86-0x00000000000D0000-0x00000000000F9000-memory.dmp cryptone behavioral1/memory/1584-91-0x0000000000400000-0x0000000000446000-memory.dmp cryptone -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exemspaint.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\Mqqkqw = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Mqqkqw.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exemspaint.exedescription ioc process File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\I: svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exedescription pid process target process PID 1584 set thread context of 1172 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchost.exe2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exepid process 1452 svchost.exe 1172 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exepid process 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.execalc.exesvchost.exemspaint.exedescription pid process Token: SeDebugPrivilege 1172 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe Token: SeDebugPrivilege 832 calc.exe Token: SeDebugPrivilege 1452 svchost.exe Token: SeDebugPrivilege 376 mspaint.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exesvchost.exe2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exedescription pid process target process PID 1584 wrote to memory of 1452 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe svchost.exe PID 1584 wrote to memory of 1452 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe svchost.exe PID 1584 wrote to memory of 1452 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe svchost.exe PID 1584 wrote to memory of 1452 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe svchost.exe PID 1584 wrote to memory of 1452 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe svchost.exe PID 1584 wrote to memory of 832 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe calc.exe PID 1584 wrote to memory of 832 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe calc.exe PID 1584 wrote to memory of 832 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe calc.exe PID 1584 wrote to memory of 832 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe calc.exe PID 1584 wrote to memory of 832 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe calc.exe PID 1584 wrote to memory of 832 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe calc.exe PID 1452 wrote to memory of 376 1452 svchost.exe mspaint.exe PID 1452 wrote to memory of 376 1452 svchost.exe mspaint.exe PID 1452 wrote to memory of 376 1452 svchost.exe mspaint.exe PID 1452 wrote to memory of 376 1452 svchost.exe mspaint.exe PID 1452 wrote to memory of 376 1452 svchost.exe mspaint.exe PID 1584 wrote to memory of 1172 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe PID 1584 wrote to memory of 1172 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe PID 1584 wrote to memory of 1172 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe PID 1584 wrote to memory of 1172 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe PID 1584 wrote to memory of 1172 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe PID 1584 wrote to memory of 1172 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe PID 1584 wrote to memory of 1172 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe PID 1584 wrote to memory of 1172 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe PID 1584 wrote to memory of 1172 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe PID 1584 wrote to memory of 1172 1584 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe PID 1172 wrote to memory of 1452 1172 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe svchost.exe PID 1172 wrote to memory of 1452 1172 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe svchost.exe PID 1172 wrote to memory of 832 1172 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe calc.exe PID 1172 wrote to memory of 832 1172 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe calc.exe PID 1172 wrote to memory of 376 1172 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe mspaint.exe PID 1172 wrote to memory of 376 1172 2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe"C:\Users\Admin\AppData\Local\Temp\2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\SysWOW64\mspaint.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe"C:\Users\Admin\AppData\Local\Temp\2593e25ff0b8df13067071ca27532c46e9de52cadb3b0159a8879f68d2d12762.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/376-90-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/376-251-0x0000000000330000-0x000000000037E000-memory.dmpFilesize
312KB
-
memory/376-107-0x0000000000330000-0x000000000037E000-memory.dmpFilesize
312KB
-
memory/376-138-0x0000000000330000-0x000000000037E000-memory.dmpFilesize
312KB
-
memory/376-127-0x0000000000330000-0x000000000037E000-memory.dmpFilesize
312KB
-
memory/376-123-0x0000000000330000-0x000000000037E000-memory.dmpFilesize
312KB
-
memory/376-119-0x0000000000330000-0x000000000037E000-memory.dmpFilesize
312KB
-
memory/376-67-0x0000000000000000-mapping.dmp
-
memory/376-69-0x0000000000D81000-0x0000000000D83000-memory.dmpFilesize
8KB
-
memory/376-71-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/376-72-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/376-73-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/376-115-0x0000000000330000-0x000000000037E000-memory.dmpFilesize
312KB
-
memory/376-70-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/376-111-0x0000000000330000-0x000000000037E000-memory.dmpFilesize
312KB
-
memory/832-118-0x0000000000360000-0x00000000003AE000-memory.dmpFilesize
312KB
-
memory/832-102-0x0000000000360000-0x00000000003AE000-memory.dmpFilesize
312KB
-
memory/832-252-0x0000000000398000-0x000000000039A000-memory.dmpFilesize
8KB
-
memory/832-88-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/832-250-0x0000000000360000-0x00000000003AE000-memory.dmpFilesize
312KB
-
memory/832-134-0x0000000000360000-0x00000000003AE000-memory.dmpFilesize
312KB
-
memory/832-110-0x0000000000360000-0x00000000003AE000-memory.dmpFilesize
312KB
-
memory/832-126-0x0000000000360000-0x00000000003AE000-memory.dmpFilesize
312KB
-
memory/832-122-0x0000000000360000-0x00000000003AE000-memory.dmpFilesize
312KB
-
memory/832-60-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/832-62-0x0000000000000000-mapping.dmp
-
memory/832-98-0x0000000000360000-0x00000000003AE000-memory.dmpFilesize
312KB
-
memory/832-114-0x0000000000360000-0x00000000003AE000-memory.dmpFilesize
312KB
-
memory/1172-75-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1172-89-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1172-81-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1172-74-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1172-83-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1172-92-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1172-84-0x0000000000410910-mapping.dmp
-
memory/1172-79-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1172-77-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1172-109-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1452-59-0x0000000000000000-mapping.dmp
-
memory/1452-86-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1452-57-0x00000000000D0000-0x00000000000F9000-memory.dmpFilesize
164KB
-
memory/1452-100-0x0000000000270000-0x00000000002BE000-memory.dmpFilesize
312KB
-
memory/1584-91-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1584-56-0x0000000000400000-0x0000000000446000-memory.dmpFilesize
280KB
-
memory/1584-55-0x0000000000240000-0x0000000000259000-memory.dmpFilesize
100KB
-
memory/1584-54-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB