Analysis
-
max time kernel
173s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 13:18
Static task
static1
Behavioral task
behavioral1
Sample
2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe
Resource
win10v2004-20221111-en
General
-
Target
2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe
-
Size
159KB
-
MD5
9fc1852d31118477de3de2980a84d869
-
SHA1
d6ae96b3d6d454507a340a51d32fb029686bc06f
-
SHA256
2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375
-
SHA512
9fa384b93565adfec399f4fbea0a595f304cd02e4d2cb0fcc208e3d8113d6d8914b6f4857d7b3bc94fe4aa394547ab3420c75a11ef7dce0ea5927a11cafa4520
-
SSDEEP
3072:Aat8Y6bDtsAngoHLFungN1BM4U+VFrw550u8BLaQzOvetdK:bt8Y6bDtsrncBdtrwsVBaPAd
Malware Config
Signatures
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exesvchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion 2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion svchost.exe -
Deletes itself 1 IoCs
Processes:
cmd.exepid process 364 cmd.exe -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\Update = "C:\\Users\\Admin\\AppData\\Roaming\\2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe" svchost.exe -
Sets desktop wallpaper using registry 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\F306B858.bmp\U0001a060l" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\Pictures\\My Wallpaper.jpg" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exedescription pid process target process PID 1792 set thread context of 1316 1792 2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe svchost.exe -
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Internet Explorer\Main svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exesvchost.exepid process 1792 2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe 1316 svchost.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exepid process 1792 2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
svchost.exepid process 1316 svchost.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
svchost.exepid process 1316 svchost.exe 1316 svchost.exe -
Suspicious use of WriteProcessMemory 14 IoCs
Processes:
2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exesvchost.exedescription pid process target process PID 1792 wrote to memory of 1316 1792 2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe svchost.exe PID 1792 wrote to memory of 1316 1792 2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe svchost.exe PID 1792 wrote to memory of 1316 1792 2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe svchost.exe PID 1792 wrote to memory of 1316 1792 2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe svchost.exe PID 1792 wrote to memory of 1316 1792 2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe svchost.exe PID 1792 wrote to memory of 1316 1792 2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe svchost.exe PID 1316 wrote to memory of 364 1316 svchost.exe cmd.exe PID 1316 wrote to memory of 364 1316 svchost.exe cmd.exe PID 1316 wrote to memory of 364 1316 svchost.exe cmd.exe PID 1316 wrote to memory of 364 1316 svchost.exe cmd.exe PID 1316 wrote to memory of 1816 1316 svchost.exe ctfmon.exe PID 1316 wrote to memory of 1816 1316 svchost.exe ctfmon.exe PID 1316 wrote to memory of 1816 1316 svchost.exe ctfmon.exe PID 1316 wrote to memory of 1816 1316 svchost.exe ctfmon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe"C:\Users\Admin\AppData\Local\Temp\2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe"1⤵
- Checks BIOS information in registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Checks BIOS information in registry
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /q /c for /l %i in (1, 1, 4000000000) do if not exist "C:\Users\Admin\AppData\Local\Temp\2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe" (exit) else (del /f "C:\Users\Admin\AppData\Local\Temp\2aef8787ba562a6f45a622d7241dc31e482d8a418845fb2816db2fb8dfc5a375.exe")3⤵
- Deletes itself
-
C:\Windows\SysWOW64\ctfmon.exectfmon.exe3⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/364-62-0x0000000000000000-mapping.dmp
-
memory/1316-58-0x0000000000401000-mapping.dmp
-
memory/1316-61-0x0000000000400000-0x000000000043E000-memory.dmpFilesize
248KB
-
memory/1792-54-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1792-55-0x00000000002D0000-0x0000000000308000-memory.dmpFilesize
224KB
-
memory/1792-56-0x0000000076381000-0x0000000076383000-memory.dmpFilesize
8KB
-
memory/1792-57-0x0000000000400000-0x0000000000438000-memory.dmpFilesize
224KB
-
memory/1792-60-0x00000000002D0000-0x0000000000308000-memory.dmpFilesize
224KB
-
memory/1816-63-0x0000000000000000-mapping.dmp