Analysis
- max time kernel
150s - max time network
151s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
27/11/2022, 15:03
Static task
static1
Behavioral task
behavioral1
Sample
c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe
- Size 263KB
- Sample221127-se2jfaba9s
- SHA256 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613
- MD5 b02ecc516834373f753b4a56428780f1
- SHA1 9277f800d44bb7f9b184a8b517bcefc3a2dac752
- SHA512 78dba7da8f9891299baf98f62c3b8f1991a4a8d52eac4e5d16c831dd5371aec4ba5800faeb188fca3bf170a83cd437f78445a5d309d1d2b4b80af4b698531535
- SSDEEP 6144:dPfLIcvFM9DZIhYz4sBc/p7ESYyq33Z7EIKTkq:GvsiIQtHZWk
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{1DC3AF6C-D547-46F8-BDF5-5EE59458E932}\\f5ea51da.exe" explorer.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{1DC3AF6C-D547-46F8-BDF5-5EE59458E932}\\f5ea51da.exe" explorer.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run explorer.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1408 set thread context of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe - Suspicious behavior: MapViewOfSection 24 IoCs
pid Process 824 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 824 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe 672 explorer.exe - Suspicious use of AdjustPrivilegeToken 59 IoCs
description pid Process Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeDebugPrivilege 672 explorer.exe Token: SeAssignPrimaryTokenPrivilege 868 Process not Found Token: SeIncreaseQuotaPrivilege 868 Process not Found Token: SeSecurityPrivilege 868 Process not Found Token: SeTakeOwnershipPrivilege 868 Process not Found Token: SeLoadDriverPrivilege 868 Process not Found Token: SeRestorePrivilege 868 Process not Found Token: SeSystemEnvironmentPrivilege 868 Process not Found Token: SeAssignPrimaryTokenPrivilege 868 Process not Found Token: SeIncreaseQuotaPrivilege 868 Process not Found Token: SeSecurityPrivilege 868 Process not Found Token: SeTakeOwnershipPrivilege 868 Process not Found Token: SeLoadDriverPrivilege 868 Process not Found Token: SeSystemtimePrivilege 868 Process not Found Token: SeBackupPrivilege 868 Process not Found Token: SeRestorePrivilege 868 Process not Found Token: SeShutdownPrivilege 868 Process not Found Token: SeSystemEnvironmentPrivilege 868 Process not Found Token: SeUndockPrivilege 868 Process not Found Token: SeManageVolumePrivilege 868 Process not Found Token: SeAssignPrimaryTokenPrivilege 868 Process not Found Token: SeIncreaseQuotaPrivilege 868 Process not Found Token: SeSecurityPrivilege 868 Process not Found Token: SeTakeOwnershipPrivilege 868 Process not Found Token: SeLoadDriverPrivilege 868 Process not Found Token: SeRestorePrivilege 868 Process not Found Token: SeSystemEnvironmentPrivilege 868 Process not Found Token: SeAssignPrimaryTokenPrivilege 868 Process not Found Token: SeIncreaseQuotaPrivilege 868 Process not Found Token: SeSecurityPrivilege 868 Process not Found Token: SeTakeOwnershipPrivilege 868 Process not Found Token: SeLoadDriverPrivilege 868 Process not Found Token: SeRestorePrivilege 868 Process not Found Token: SeSystemEnvironmentPrivilege 868 Process not Found Token: SeAuditPrivilege 868 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1272 Process not Found 1272 Process not Found - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1272 Process not Found 1272 Process not Found - Suspicious use of UnmapMainImage 5 IoCs
pid Process 800 Process not Found 800 Process not Found 800 Process not Found 800 Process not Found 800 Process not Found - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 1408 wrote to memory of 824 1408 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 26 PID 824 wrote to memory of 672 824 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 27 PID 824 wrote to memory of 672 824 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 27 PID 824 wrote to memory of 672 824 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 27 PID 824 wrote to memory of 672 824 c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe"C:\Users\Admin\AppData\Local\Temp\c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Users\Admin\AppData\Local\Temp\c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe"C:\Users\Admin\AppData\Local\Temp\c3b3fcc4d911d24473bf0a1b42e93de250b4ecf1b74632158a54c68013403613.exe"2⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:824 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:672
-
-