Analysis
-
max time kernel
146s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
26-11-2022 16:50
Static task
static1
Behavioral task
behavioral1
Sample
1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe
Resource
win10v2004-20221111-en
General
-
Target
1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe
-
Size
258KB
-
MD5
d97d7777cc2dbf94761a741f98562ce1
-
SHA1
f142ed9523eb296f616b15434a72998c22048357
-
SHA256
1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61
-
SHA512
7a927eaaaf679c26981b9d7190000641a49d11395a2f57c23315a3e12fadc086fad2d67714ac19864eebc3ccbe00fb757432a16cc8e196e435c82de88da4d2eb
-
SSDEEP
3072:awtEktkLPAy4SgHkDD3F+s0lBDN3CgxgjGPOWvn2AYd1IyzSF2f:ttqapHt/J3hxgjmjsDzSof
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4640-133-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral2/memory/3856-140-0x00000000010D0000-0x00000000010F9000-memory.dmp cryptone behavioral2/memory/4640-139-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral2/memory/2344-141-0x0000000000C20000-0x0000000000C49000-memory.dmp cryptone behavioral2/memory/3856-142-0x00000000010D0000-0x00000000010F9000-memory.dmp cryptone behavioral2/memory/3856-143-0x00000000010D0000-0x00000000010F9000-memory.dmp cryptone behavioral2/memory/4640-148-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral2/memory/2344-152-0x0000000000C20000-0x0000000000C49000-memory.dmp cryptone -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exemspaint.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2386679933-1492765628-3466841596-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Hrspsw = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Hrspsw.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exemspaint.exedescription ioc process File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\U: svchost.exe File opened (read-only) \??\Y: svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exedescription pid process target process PID 4720 set thread context of 4640 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4640 set thread context of 1536 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exesvchost.exe1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exepid process 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 2344 svchost.exe 2344 svchost.exe 1536 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1536 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1536 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exepid process 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exesvchost.execalc.exemspaint.exedescription pid process Token: SeDebugPrivilege 1536 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe Token: SeDebugPrivilege 2344 svchost.exe Token: SeDebugPrivilege 4048 calc.exe Token: SeDebugPrivilege 3856 mspaint.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exesvchost.exe1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exedescription pid process target process PID 4720 wrote to memory of 4640 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4720 wrote to memory of 4640 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4720 wrote to memory of 4640 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4720 wrote to memory of 4640 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4720 wrote to memory of 4640 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4720 wrote to memory of 4640 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4720 wrote to memory of 4640 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4720 wrote to memory of 4640 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4720 wrote to memory of 4640 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4720 wrote to memory of 4640 4720 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4640 wrote to memory of 2344 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe svchost.exe PID 4640 wrote to memory of 2344 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe svchost.exe PID 4640 wrote to memory of 2344 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe svchost.exe PID 4640 wrote to memory of 2344 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe svchost.exe PID 4640 wrote to memory of 4048 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe calc.exe PID 4640 wrote to memory of 4048 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe calc.exe PID 4640 wrote to memory of 4048 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe calc.exe PID 4640 wrote to memory of 4048 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe calc.exe PID 4640 wrote to memory of 4048 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe calc.exe PID 2344 wrote to memory of 3856 2344 svchost.exe mspaint.exe PID 2344 wrote to memory of 3856 2344 svchost.exe mspaint.exe PID 2344 wrote to memory of 3856 2344 svchost.exe mspaint.exe PID 2344 wrote to memory of 3856 2344 svchost.exe mspaint.exe PID 4640 wrote to memory of 1536 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4640 wrote to memory of 1536 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4640 wrote to memory of 1536 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4640 wrote to memory of 1536 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4640 wrote to memory of 1536 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4640 wrote to memory of 1536 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4640 wrote to memory of 1536 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4640 wrote to memory of 1536 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 4640 wrote to memory of 1536 4640 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe PID 1536 wrote to memory of 2344 1536 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe svchost.exe PID 1536 wrote to memory of 2344 1536 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe svchost.exe PID 1536 wrote to memory of 4048 1536 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe calc.exe PID 1536 wrote to memory of 4048 1536 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe calc.exe PID 1536 wrote to memory of 3856 1536 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe mspaint.exe PID 1536 wrote to memory of 3856 1536 1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe"C:\Users\Admin\AppData\Local\Temp\1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe"C:\Users\Admin\AppData\Local\Temp\1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\SysWOW64\mspaint.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe"C:\Users\Admin\AppData\Local\Temp\1aaee3caabfceecbd5c25caa4a1c3d5d7517f0b5b252d2e59367d1aadb400f61.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1536-145-0x0000000000000000-mapping.dmp
-
memory/1536-156-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1536-151-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1536-149-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1536-146-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2344-152-0x0000000000C20000-0x0000000000C49000-memory.dmpFilesize
164KB
-
memory/2344-136-0x0000000000000000-mapping.dmp
-
memory/2344-157-0x0000000000C60000-0x0000000000CAE000-memory.dmpFilesize
312KB
-
memory/2344-141-0x0000000000C20000-0x0000000000C49000-memory.dmpFilesize
164KB
-
memory/2344-153-0x0000000000C60000-0x0000000000CAE000-memory.dmpFilesize
312KB
-
memory/3856-150-0x00000000010D0000-0x00000000010F9000-memory.dmpFilesize
164KB
-
memory/3856-155-0x0000000001110000-0x000000000115E000-memory.dmpFilesize
312KB
-
memory/3856-138-0x0000000000000000-mapping.dmp
-
memory/3856-144-0x00000000010D0000-0x00000000010F9000-memory.dmpFilesize
164KB
-
memory/3856-143-0x00000000010D0000-0x00000000010F9000-memory.dmpFilesize
164KB
-
memory/3856-140-0x00000000010D0000-0x00000000010F9000-memory.dmpFilesize
164KB
-
memory/3856-159-0x0000000001110000-0x000000000115E000-memory.dmpFilesize
312KB
-
memory/3856-142-0x00000000010D0000-0x00000000010F9000-memory.dmpFilesize
164KB
-
memory/4048-137-0x0000000000000000-mapping.dmp
-
memory/4048-158-0x0000000002C90000-0x0000000002CDE000-memory.dmpFilesize
312KB
-
memory/4048-154-0x0000000002C90000-0x0000000002CDE000-memory.dmpFilesize
312KB
-
memory/4640-148-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4640-133-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4640-139-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4640-132-0x0000000000000000-mapping.dmp
-
memory/4720-135-0x00000000014A0000-0x00000000014BA000-memory.dmpFilesize
104KB