Analysis
-
max time kernel
86s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 21:21
Static task
static1
Behavioral task
behavioral1
Sample
f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exe
Resource
win10v2004-20220812-en
General
-
Target
f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exe
-
Size
1.1MB
-
MD5
b87c0de9804e714ff7dedc66d9fcb044
-
SHA1
560e055432b2efd5cec1639e4cf7b05149f8d90c
-
SHA256
f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90
-
SHA512
57d7058cd8d576f6ad3251ff8b1d9ce8d3fbac68efd4ca7a0e0cadd30848fc87e6f57f62e8cce9b39df80a28d702e00a6a3ba7bcd1db77a9ff1d14ee042d90ef
-
SSDEEP
24576:8gUCLpFE5XT37g5lNFhNsdvQ4Ri1v8SI+y8HTYa:8GjQwfNFhNsdYX8SI+vY
Malware Config
Signatures
-
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
svchost.exepid process 1212 svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exesvchost.exepid process 1812 f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exe 1212 svchost.exe 1212 svchost.exe 1212 svchost.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Realtek Difference audio = "\"C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe\"" svchost.exe -
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA svchost.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 svchost.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier svchost.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
Processes:
svchost.exepid process 1212 svchost.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exesvchost.exedescription pid process Token: SeDebugPrivilege 1812 f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exe Token: SeDebugPrivilege 1212 svchost.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exedescription pid process target process PID 1812 wrote to memory of 1212 1812 f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exe svchost.exe PID 1812 wrote to memory of 1212 1812 f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exe svchost.exe PID 1812 wrote to memory of 1212 1812 f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exe svchost.exe PID 1812 wrote to memory of 1212 1812 f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exe svchost.exe -
System policy modification 1 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exe"C:\Users\Admin\AppData\Local\Temp\f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\svchost.exe"C:\Users\Admin\AppData\Roaming\svchost.exe"2⤵
- UAC bypass
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
1.1MB
MD5b87c0de9804e714ff7dedc66d9fcb044
SHA1560e055432b2efd5cec1639e4cf7b05149f8d90c
SHA256f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90
SHA51257d7058cd8d576f6ad3251ff8b1d9ce8d3fbac68efd4ca7a0e0cadd30848fc87e6f57f62e8cce9b39df80a28d702e00a6a3ba7bcd1db77a9ff1d14ee042d90ef
-
C:\Users\Admin\AppData\Roaming\svchost.exeFilesize
1.1MB
MD5b87c0de9804e714ff7dedc66d9fcb044
SHA1560e055432b2efd5cec1639e4cf7b05149f8d90c
SHA256f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90
SHA51257d7058cd8d576f6ad3251ff8b1d9ce8d3fbac68efd4ca7a0e0cadd30848fc87e6f57f62e8cce9b39df80a28d702e00a6a3ba7bcd1db77a9ff1d14ee042d90ef
-
\Users\Admin\AppData\Local\Temp\b0494a1f-4bd3-KX9rGV8JlgyIgeoji9hdGA==\System.Data.SQLite.dllFilesize
1.1MB
MD569650aaa6033dc84914ea1538d370ccc
SHA11b9e7bc59456d2ae0c0f245619ec14b4081e0672
SHA256c7df2f8d1e6ec4bdf612df0165fa8f2cfe45e526c2bbd4f8c45ef47378bc2f91
SHA51260b12172a9d854ae7432ad624d9b0930049eb5ce8646cea23229ba58acc0355562438275fab9d72dbe67238acc441daf3b16a9e73fcb4945606811eaa6ede64e
-
\Users\Admin\AppData\Local\Temp\b0494a1f-4bd3-KX9rGV8JlgyIgeoji9hdGA==\System.Data.SQLite.dllFilesize
1.1MB
MD569650aaa6033dc84914ea1538d370ccc
SHA11b9e7bc59456d2ae0c0f245619ec14b4081e0672
SHA256c7df2f8d1e6ec4bdf612df0165fa8f2cfe45e526c2bbd4f8c45ef47378bc2f91
SHA51260b12172a9d854ae7432ad624d9b0930049eb5ce8646cea23229ba58acc0355562438275fab9d72dbe67238acc441daf3b16a9e73fcb4945606811eaa6ede64e
-
\Users\Admin\AppData\Local\Temp\b0494a1f-4bd3-KX9rGV8JlgyIgeoji9hdGA==\System.Data.SQLite.dllFilesize
1.1MB
MD569650aaa6033dc84914ea1538d370ccc
SHA11b9e7bc59456d2ae0c0f245619ec14b4081e0672
SHA256c7df2f8d1e6ec4bdf612df0165fa8f2cfe45e526c2bbd4f8c45ef47378bc2f91
SHA51260b12172a9d854ae7432ad624d9b0930049eb5ce8646cea23229ba58acc0355562438275fab9d72dbe67238acc441daf3b16a9e73fcb4945606811eaa6ede64e
-
\Users\Admin\AppData\Roaming\svchost.exeFilesize
1.1MB
MD5b87c0de9804e714ff7dedc66d9fcb044
SHA1560e055432b2efd5cec1639e4cf7b05149f8d90c
SHA256f2379aabaa8d5909ba7c89953ddf701c346dee31adb29c962198e5cf376a3a90
SHA51257d7058cd8d576f6ad3251ff8b1d9ce8d3fbac68efd4ca7a0e0cadd30848fc87e6f57f62e8cce9b39df80a28d702e00a6a3ba7bcd1db77a9ff1d14ee042d90ef
-
memory/1212-57-0x0000000000000000-mapping.dmp
-
memory/1212-62-0x0000000005A20000-0x0000000005BC6000-memory.dmpFilesize
1.6MB
-
memory/1212-63-0x0000000005BD0000-0x0000000005CF9000-memory.dmpFilesize
1.2MB
-
memory/1212-60-0x0000000001300000-0x000000000141C000-memory.dmpFilesize
1.1MB
-
memory/1212-66-0x0000000005D00000-0x0000000005E29000-memory.dmpFilesize
1.2MB
-
memory/1212-68-0x0000000000A00000-0x0000000000A20000-memory.dmpFilesize
128KB
-
memory/1212-69-0x0000000004DD0000-0x0000000004E52000-memory.dmpFilesize
520KB
-
memory/1812-54-0x00000000003F0000-0x000000000050C000-memory.dmpFilesize
1.1MB
-
memory/1812-55-0x0000000076091000-0x0000000076093000-memory.dmpFilesize
8KB