Analysis
-
max time kernel
136s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 15:03
Static task
static1
Behavioral task
behavioral1
Sample
822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe
Resource
win10v2004-20221111-en
General
-
Target
822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe
-
Size
207KB
-
MD5
a595882631d831d266034cc913cb3c6a
-
SHA1
4aa6c8e48e6b8ccdb592c07003946bdca9316d75
-
SHA256
822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85
-
SHA512
d24e2e597850bf6d9544429d57515be8f39d19d05f329c49c699bedbeb57f92dc6f2a06ba4af9ea2f4223f7553755df38c6c54cdc269398edfbe4941da5badeb
-
SSDEEP
3072:AksIbF+0KI9gqR+/vJ8se/CLtlMcjX+Io7AlE6jyOAZ2kds5NGG9:R0W9gt9LDT+T7AGulAZ2kUUo
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/1160-64-0x0000000000400000-0x0000000000452000-memory.dmp cryptone behavioral1/memory/1996-65-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1516-71-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1516-72-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1516-73-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone behavioral1/memory/1160-87-0x0000000000400000-0x0000000000452000-memory.dmp cryptone behavioral1/memory/1996-92-0x0000000000080000-0x00000000000A9000-memory.dmp cryptone -
Deletes itself 1 IoCs
Processes:
notepad.exepid process 1516 notepad.exe -
Adds Run key to start application 2 TTPs 3 IoCs
Processes:
svchost.exenotepad.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run notepad.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Kxnrnb = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Kxnrnb.exe" notepad.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exenotepad.exedescription ioc process File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\D: notepad.exe File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\U: svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exedescription pid process target process PID 1160 set thread context of 1168 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
svchost.exe822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exepid process 1996 svchost.exe 1168 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exesvchost.execalc.exenotepad.exedescription pid process Token: SeDebugPrivilege 1168 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe Token: SeDebugPrivilege 1996 svchost.exe Token: SeDebugPrivilege 1416 calc.exe Token: SeDebugPrivilege 1516 notepad.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exesvchost.exe822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exedescription pid process target process PID 1160 wrote to memory of 1996 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe svchost.exe PID 1160 wrote to memory of 1996 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe svchost.exe PID 1160 wrote to memory of 1996 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe svchost.exe PID 1160 wrote to memory of 1996 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe svchost.exe PID 1160 wrote to memory of 1996 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe svchost.exe PID 1160 wrote to memory of 1416 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe calc.exe PID 1160 wrote to memory of 1416 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe calc.exe PID 1160 wrote to memory of 1416 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe calc.exe PID 1160 wrote to memory of 1416 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe calc.exe PID 1160 wrote to memory of 1416 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe calc.exe PID 1160 wrote to memory of 1416 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe calc.exe PID 1996 wrote to memory of 1516 1996 svchost.exe notepad.exe PID 1996 wrote to memory of 1516 1996 svchost.exe notepad.exe PID 1996 wrote to memory of 1516 1996 svchost.exe notepad.exe PID 1996 wrote to memory of 1516 1996 svchost.exe notepad.exe PID 1996 wrote to memory of 1516 1996 svchost.exe notepad.exe PID 1160 wrote to memory of 1168 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe PID 1160 wrote to memory of 1168 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe PID 1160 wrote to memory of 1168 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe PID 1160 wrote to memory of 1168 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe PID 1160 wrote to memory of 1168 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe PID 1160 wrote to memory of 1168 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe PID 1160 wrote to memory of 1168 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe PID 1160 wrote to memory of 1168 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe PID 1160 wrote to memory of 1168 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe PID 1160 wrote to memory of 1168 1160 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe PID 1168 wrote to memory of 1996 1168 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe svchost.exe PID 1168 wrote to memory of 1996 1168 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe svchost.exe PID 1168 wrote to memory of 1416 1168 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe calc.exe PID 1168 wrote to memory of 1416 1168 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe calc.exe PID 1168 wrote to memory of 1516 1168 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe notepad.exe PID 1168 wrote to memory of 1516 1168 822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe notepad.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe"C:\Users\Admin\AppData\Local\Temp\822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"2⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\notepad.exe"C:\Windows\SysWOW64\notepad.exe"3⤵
- Deletes itself
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe"C:\Users\Admin\AppData\Local\Temp\822498f3c8d3183053e41e60f2eca060ca82e5c7fa2dbcff0052fdc2cae84f85.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1160-63-0x00000000003D0000-0x00000000003E3000-memory.dmpFilesize
76KB
-
memory/1160-87-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1160-54-0x0000000075A91000-0x0000000075A93000-memory.dmpFilesize
8KB
-
memory/1160-64-0x0000000000400000-0x0000000000452000-memory.dmpFilesize
328KB
-
memory/1168-115-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1168-84-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1168-90-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1168-89-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1168-85-0x0000000000410910-mapping.dmp
-
memory/1168-82-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1168-80-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1168-78-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1168-76-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1168-75-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/1416-119-0x00000000001E0000-0x000000000022E000-memory.dmpFilesize
312KB
-
memory/1416-102-0x00000000001E0000-0x000000000022E000-memory.dmpFilesize
312KB
-
memory/1416-123-0x00000000001E0000-0x000000000022E000-memory.dmpFilesize
312KB
-
memory/1416-114-0x00000000001E0000-0x000000000022E000-memory.dmpFilesize
312KB
-
memory/1416-131-0x00000000001E0000-0x000000000022E000-memory.dmpFilesize
312KB
-
memory/1416-66-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/1416-61-0x0000000000000000-mapping.dmp
-
memory/1416-332-0x00000000001E0000-0x000000000022E000-memory.dmpFilesize
312KB
-
memory/1416-127-0x00000000001E0000-0x000000000022E000-memory.dmpFilesize
312KB
-
memory/1416-58-0x0000000000080000-0x0000000000082000-memory.dmpFilesize
8KB
-
memory/1416-106-0x00000000001E0000-0x000000000022E000-memory.dmpFilesize
312KB
-
memory/1516-72-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1516-71-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1516-334-0x0000000000150000-0x000000000019E000-memory.dmpFilesize
312KB
-
memory/1516-132-0x0000000000150000-0x000000000019E000-memory.dmpFilesize
312KB
-
memory/1516-110-0x0000000000150000-0x000000000019E000-memory.dmpFilesize
312KB
-
memory/1516-69-0x0000000000000000-mapping.dmp
-
memory/1516-91-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1516-74-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1516-122-0x0000000000150000-0x000000000019E000-memory.dmpFilesize
312KB
-
memory/1516-73-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1996-118-0x0000000000110000-0x000000000015E000-memory.dmpFilesize
312KB
-
memory/1996-97-0x0000000000110000-0x000000000015E000-memory.dmpFilesize
312KB
-
memory/1996-130-0x0000000000110000-0x000000000015E000-memory.dmpFilesize
312KB
-
memory/1996-109-0x0000000000110000-0x000000000015E000-memory.dmpFilesize
312KB
-
memory/1996-92-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1996-65-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1996-126-0x0000000000110000-0x000000000015E000-memory.dmpFilesize
312KB
-
memory/1996-57-0x0000000000000000-mapping.dmp
-
memory/1996-55-0x0000000000080000-0x00000000000A9000-memory.dmpFilesize
164KB
-
memory/1996-333-0x0000000000110000-0x000000000015E000-memory.dmpFilesize
312KB
-
memory/1996-100-0x0000000000110000-0x000000000015E000-memory.dmpFilesize
312KB