Analysis
-
max time kernel
226s -
max time network
216s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 13:53
Static task
static1
Behavioral task
behavioral1
Sample
b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe
Resource
win10v2004-20220901-en
General
-
Target
b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe
-
Size
267KB
-
MD5
03f81f69db69634c13210bae6b4598f4
-
SHA1
6710382e4f58f97f99fca1ae6b189fcc67e9011d
-
SHA256
b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5
-
SHA512
f7f8cd15d01fd26b03881811e27356179deaafe3afd6a1b7b908edbab0357f52d8c3753c179c666c6df18e32cd784252c4cd92cd7e1ff21bd1981228708aa1f8
-
SSDEEP
6144:LIl3YnIIHBJ0X4U3cCIUqWzInoBdm4XORyGB7W0OnyYLSAXQ:ElYhQ4UMCIMdw3BTOyYLlg
Malware Config
Signatures
-
Luminosity
Luminosity is a RAT family that was on sale, while claiming to be a system administration utility.
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,\"C:\\ProgramData\\788257\\sysconfig.exe\"" sysconfig.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,\"C:\\Windows\\system32\\clientsvr.exe\"" sysconfig.exe -
Executes dropped EXE 2 IoCs
pid Process 1160 sysconfig.exe 1628 sysconfig.exe -
Loads dropped DLL 2 IoCs
pid Process 692 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 692 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1214520366-621468234-4062160515-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\System Configuration = "\"C:\\ProgramData\\788257\\sysconfig.exe\"" sysconfig.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\clientsvr.exe sysconfig.exe File opened for modification C:\Windows\SysWOW64\clientsvr.exe sysconfig.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 520 set thread context of 692 520 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 28 PID 1160 set thread context of 1628 1160 sysconfig.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 1628 sysconfig.exe 1628 sysconfig.exe 1628 sysconfig.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 692 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 520 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe Token: SeDebugPrivilege 1160 sysconfig.exe Token: SeDebugPrivilege 1628 sysconfig.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1628 sysconfig.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 520 wrote to memory of 692 520 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 28 PID 520 wrote to memory of 692 520 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 28 PID 520 wrote to memory of 692 520 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 28 PID 520 wrote to memory of 692 520 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 28 PID 520 wrote to memory of 692 520 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 28 PID 520 wrote to memory of 692 520 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 28 PID 520 wrote to memory of 692 520 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 28 PID 520 wrote to memory of 692 520 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 28 PID 520 wrote to memory of 692 520 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 28 PID 692 wrote to memory of 1160 692 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 30 PID 692 wrote to memory of 1160 692 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 30 PID 692 wrote to memory of 1160 692 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 30 PID 692 wrote to memory of 1160 692 b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe 30 PID 1160 wrote to memory of 1628 1160 sysconfig.exe 31 PID 1160 wrote to memory of 1628 1160 sysconfig.exe 31 PID 1160 wrote to memory of 1628 1160 sysconfig.exe 31 PID 1160 wrote to memory of 1628 1160 sysconfig.exe 31 PID 1160 wrote to memory of 1628 1160 sysconfig.exe 31 PID 1160 wrote to memory of 1628 1160 sysconfig.exe 31 PID 1160 wrote to memory of 1628 1160 sysconfig.exe 31 PID 1160 wrote to memory of 1628 1160 sysconfig.exe 31 PID 1160 wrote to memory of 1628 1160 sysconfig.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe"C:\Users\Admin\AppData\Local\Temp\b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:520 -
C:\Users\Admin\AppData\Local\Temp\b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe"C:\Users\Admin\AppData\Local\Temp\b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:692 -
C:\ProgramData\788257\sysconfig.exe"C:\ProgramData\788257\sysconfig.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1160 -
C:\ProgramData\788257\sysconfig.exe"C:\ProgramData\788257\sysconfig.exe"4⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1628
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
267KB
MD503f81f69db69634c13210bae6b4598f4
SHA16710382e4f58f97f99fca1ae6b189fcc67e9011d
SHA256b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5
SHA512f7f8cd15d01fd26b03881811e27356179deaafe3afd6a1b7b908edbab0357f52d8c3753c179c666c6df18e32cd784252c4cd92cd7e1ff21bd1981228708aa1f8
-
Filesize
267KB
MD503f81f69db69634c13210bae6b4598f4
SHA16710382e4f58f97f99fca1ae6b189fcc67e9011d
SHA256b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5
SHA512f7f8cd15d01fd26b03881811e27356179deaafe3afd6a1b7b908edbab0357f52d8c3753c179c666c6df18e32cd784252c4cd92cd7e1ff21bd1981228708aa1f8
-
Filesize
267KB
MD503f81f69db69634c13210bae6b4598f4
SHA16710382e4f58f97f99fca1ae6b189fcc67e9011d
SHA256b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5
SHA512f7f8cd15d01fd26b03881811e27356179deaafe3afd6a1b7b908edbab0357f52d8c3753c179c666c6df18e32cd784252c4cd92cd7e1ff21bd1981228708aa1f8
-
Filesize
267KB
MD503f81f69db69634c13210bae6b4598f4
SHA16710382e4f58f97f99fca1ae6b189fcc67e9011d
SHA256b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5
SHA512f7f8cd15d01fd26b03881811e27356179deaafe3afd6a1b7b908edbab0357f52d8c3753c179c666c6df18e32cd784252c4cd92cd7e1ff21bd1981228708aa1f8
-
Filesize
267KB
MD503f81f69db69634c13210bae6b4598f4
SHA16710382e4f58f97f99fca1ae6b189fcc67e9011d
SHA256b9694c6ae1d20d43f9ee72800810658b23ea0505afba30030fd474a22f3921f5
SHA512f7f8cd15d01fd26b03881811e27356179deaafe3afd6a1b7b908edbab0357f52d8c3753c179c666c6df18e32cd784252c4cd92cd7e1ff21bd1981228708aa1f8