Analysis
-
max time kernel
152s -
max time network
190s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27/11/2022, 08:40
Static task
static1
Behavioral task
behavioral1
Sample
15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
Resource
win10v2004-20221111-en
General
-
Target
15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe
-
Size
224KB
-
MD5
7009c6ab0cfad4098b7aa34bd290d780
-
SHA1
ac376f7970755415748df042fac17578a840f6fe
-
SHA256
15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc
-
SHA512
b2dbb1f7bb0dbe64452a08db0b0e7ea4b0f9f89fc2eb7475557454eac465e714daedf78ef4dfad6c58647ac1f3a864fde0491458844418d31420406dfb620ad5
-
SSDEEP
6144:TzsTjPybOwj6Vt1Ab6wjeKY44cUAvldXpj7MKCDlNULAAOT:tkt1Abu42UlLEDsAT
Malware Config
Signatures
-
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b00000001232f-54.dat acprotect behavioral1/files/0x0007000000012738-59.dat acprotect -
Executes dropped EXE 1 IoCs
pid Process 1128 gaycwq.exe -
Loads dropped DLL 2 IoCs
pid Process 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 1128 gaycwq.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\gaycwq.exe 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe File opened for modification C:\Windows\SysWOW64\gaycwq.exe 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 gaycwq.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz gaycwq.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 1128 gaycwq.exe -
Suspicious behavior: MapViewOfSection 45 IoCs
pid Process 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe 1128 gaycwq.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe Token: SeDebugPrivilege 1128 gaycwq.exe Token: SeIncBasePriorityPrivilege 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 1128 gaycwq.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 2020 wrote to memory of 368 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 25 PID 2020 wrote to memory of 368 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 25 PID 2020 wrote to memory of 368 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 25 PID 2020 wrote to memory of 368 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 25 PID 2020 wrote to memory of 368 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 25 PID 2020 wrote to memory of 368 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 25 PID 2020 wrote to memory of 368 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 25 PID 2020 wrote to memory of 384 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 24 PID 2020 wrote to memory of 384 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 24 PID 2020 wrote to memory of 384 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 24 PID 2020 wrote to memory of 384 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 24 PID 2020 wrote to memory of 384 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 24 PID 2020 wrote to memory of 384 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 24 PID 2020 wrote to memory of 384 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 24 PID 2020 wrote to memory of 420 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 23 PID 2020 wrote to memory of 420 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 23 PID 2020 wrote to memory of 420 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 23 PID 2020 wrote to memory of 420 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 23 PID 2020 wrote to memory of 420 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 23 PID 2020 wrote to memory of 420 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 23 PID 2020 wrote to memory of 420 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 23 PID 2020 wrote to memory of 472 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2 PID 2020 wrote to memory of 472 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2 PID 2020 wrote to memory of 472 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2 PID 2020 wrote to memory of 472 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2 PID 2020 wrote to memory of 472 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2 PID 2020 wrote to memory of 472 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2 PID 2020 wrote to memory of 472 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 2 PID 2020 wrote to memory of 480 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 1 PID 2020 wrote to memory of 480 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 1 PID 2020 wrote to memory of 480 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 1 PID 2020 wrote to memory of 480 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 1 PID 2020 wrote to memory of 480 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 1 PID 2020 wrote to memory of 480 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 1 PID 2020 wrote to memory of 480 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 1 PID 2020 wrote to memory of 488 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 22 PID 2020 wrote to memory of 488 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 22 PID 2020 wrote to memory of 488 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 22 PID 2020 wrote to memory of 488 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 22 PID 2020 wrote to memory of 488 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 22 PID 2020 wrote to memory of 488 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 22 PID 2020 wrote to memory of 488 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 22 PID 2020 wrote to memory of 576 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 21 PID 2020 wrote to memory of 576 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 21 PID 2020 wrote to memory of 576 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 21 PID 2020 wrote to memory of 576 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 21 PID 2020 wrote to memory of 576 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 21 PID 2020 wrote to memory of 576 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 21 PID 2020 wrote to memory of 576 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 21 PID 2020 wrote to memory of 656 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 20 PID 2020 wrote to memory of 656 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 20 PID 2020 wrote to memory of 656 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 20 PID 2020 wrote to memory of 656 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 20 PID 2020 wrote to memory of 656 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 20 PID 2020 wrote to memory of 656 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 20 PID 2020 wrote to memory of 656 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 20 PID 2020 wrote to memory of 736 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 3 PID 2020 wrote to memory of 736 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 3 PID 2020 wrote to memory of 736 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 3 PID 2020 wrote to memory of 736 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 3 PID 2020 wrote to memory of 736 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 3 PID 2020 wrote to memory of 736 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 3 PID 2020 wrote to memory of 736 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 3 PID 2020 wrote to memory of 800 2020 15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe 19
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:480
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:472
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:736
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:328
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:304
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1016
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1112
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1032
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:276
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:836
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:800
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:656
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:576
-
-
C:\Windows\SysWOW64\gaycwq.exeC:\Windows\SysWOW64\gaycwq.exe2⤵
- Executes dropped EXE
- Loads dropped DLL
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1128
-
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1716
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe1⤵PID:1976
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1248
-
C:\Users\Admin\AppData\Local\Temp\15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe"C:\Users\Admin\AppData\Local\Temp\15da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2020
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1200
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:488
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384
-
C:\Windows\system32\wininit.exewininit.exe1⤵PID:368
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
224KB
MD57009c6ab0cfad4098b7aa34bd290d780
SHA1ac376f7970755415748df042fac17578a840f6fe
SHA25615da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc
SHA512b2dbb1f7bb0dbe64452a08db0b0e7ea4b0f9f89fc2eb7475557454eac465e714daedf78ef4dfad6c58647ac1f3a864fde0491458844418d31420406dfb620ad5
-
Filesize
224KB
MD57009c6ab0cfad4098b7aa34bd290d780
SHA1ac376f7970755415748df042fac17578a840f6fe
SHA25615da34442650004fecf7d059c9ad06ca884cf9f0d1432cf549b25345b911addc
SHA512b2dbb1f7bb0dbe64452a08db0b0e7ea4b0f9f89fc2eb7475557454eac465e714daedf78ef4dfad6c58647ac1f3a864fde0491458844418d31420406dfb620ad5
-
Filesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c
-
Filesize
172KB
MD5fe763c2d71419352141c77c310e600d2
SHA16bb51ebcbde9fe5556a74319b49bea37d5542d5e
SHA2567fdf10ca02d2238e22fda18dfbede9750da9f257221802c8b86c557c19c9bc7b
SHA512147b3a525b1fef98ae46923dcbe25edfcf7b523f347857466eefa88f09ec053ba309dfbee5f1454ec64aba0518ee21986c4b6a506f8550efb1163c8f04d7482c