Analysis
-
max time kernel
145s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27-11-2022 15:10
Static task
static1
Behavioral task
behavioral1
Sample
b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe
Resource
win10v2004-20220901-en
General
-
Target
b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe
-
Size
191KB
-
MD5
e6c81c0a935b723201e297f3cec55ae4
-
SHA1
dd21b3b803105d922d64cbeccbe9474d7d841cca
-
SHA256
b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39
-
SHA512
c5cf01e63ae35bddd6b276f389c3de005f536e383feb38948e7bae72cac9fef37f52dd4eb5b05a87c9f98e399ad457eb78c898e4008da666d1b881e4826c92fc
-
SSDEEP
3072:epP3WXUQRkgydpjyGNf01DERN8fCob/gL1jJ+TcW8FB64pl4kiNWxnybz:gP3eYdriYaCaJcWaB66i8xnybz
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/4888-133-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral2/memory/2576-139-0x0000000000EF0000-0x0000000000F19000-memory.dmp cryptone behavioral2/memory/2576-141-0x0000000000EF0000-0x0000000000F19000-memory.dmp cryptone behavioral2/memory/2576-140-0x0000000000EF0000-0x0000000000F19000-memory.dmp cryptone behavioral2/memory/4888-147-0x0000000000400000-0x0000000000429000-memory.dmp cryptone behavioral2/memory/1596-149-0x0000000000A10000-0x0000000000A39000-memory.dmp cryptone -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exemspaint.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Adobe System Incorporated = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Adobe\\Reader_sl.exe" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Mtutuf = "C:\\Users\\Admin\\AppData\\Roaming\\Identities\\Mtutuf.exe" mspaint.exe -
Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
Processes:
svchost.exemspaint.exedescription ioc process File opened (read-only) \??\B: svchost.exe File opened (read-only) \??\H: svchost.exe File opened (read-only) \??\I: svchost.exe File opened (read-only) \??\L: svchost.exe File opened (read-only) \??\M: svchost.exe File opened (read-only) \??\O: svchost.exe File opened (read-only) \??\D: mspaint.exe File opened (read-only) \??\S: svchost.exe File opened (read-only) \??\E: svchost.exe File opened (read-only) \??\F: svchost.exe File opened (read-only) \??\G: svchost.exe File opened (read-only) \??\J: svchost.exe File opened (read-only) \??\Q: svchost.exe File opened (read-only) \??\R: svchost.exe File opened (read-only) \??\V: svchost.exe File opened (read-only) \??\W: svchost.exe File opened (read-only) \??\X: svchost.exe File opened (read-only) \??\Y: svchost.exe File opened (read-only) \??\Z: svchost.exe File opened (read-only) \??\K: svchost.exe File opened (read-only) \??\N: svchost.exe File opened (read-only) \??\P: svchost.exe File opened (read-only) \??\T: svchost.exe File opened (read-only) \??\U: svchost.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exeb73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exedescription pid process target process PID 4912 set thread context of 4888 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4888 set thread context of 2284 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe -
Suspicious behavior: EnumeratesProcesses 9 IoCs
Processes:
b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exesvchost.exeb73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exepid process 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe 1596 svchost.exe 1596 svchost.exe 2284 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe 2284 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe 2284 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exepid process 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exesvchost.execalc.exemspaint.exedescription pid process Token: SeDebugPrivilege 2284 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe Token: SeDebugPrivilege 1596 svchost.exe Token: SeDebugPrivilege 1916 calc.exe Token: SeDebugPrivilege 2576 mspaint.exe -
Suspicious use of WriteProcessMemory 38 IoCs
Processes:
b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exeb73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exesvchost.exeb73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exedescription pid process target process PID 4912 wrote to memory of 4888 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4912 wrote to memory of 4888 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4912 wrote to memory of 4888 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4912 wrote to memory of 4888 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4912 wrote to memory of 4888 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4912 wrote to memory of 4888 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4912 wrote to memory of 4888 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4912 wrote to memory of 4888 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4912 wrote to memory of 4888 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4912 wrote to memory of 4888 4912 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4888 wrote to memory of 1596 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe svchost.exe PID 4888 wrote to memory of 1596 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe svchost.exe PID 4888 wrote to memory of 1596 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe svchost.exe PID 4888 wrote to memory of 1596 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe svchost.exe PID 4888 wrote to memory of 1916 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe calc.exe PID 4888 wrote to memory of 1916 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe calc.exe PID 4888 wrote to memory of 1916 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe calc.exe PID 4888 wrote to memory of 1916 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe calc.exe PID 4888 wrote to memory of 1916 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe calc.exe PID 1596 wrote to memory of 2576 1596 svchost.exe mspaint.exe PID 1596 wrote to memory of 2576 1596 svchost.exe mspaint.exe PID 1596 wrote to memory of 2576 1596 svchost.exe mspaint.exe PID 1596 wrote to memory of 2576 1596 svchost.exe mspaint.exe PID 4888 wrote to memory of 2284 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4888 wrote to memory of 2284 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4888 wrote to memory of 2284 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4888 wrote to memory of 2284 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4888 wrote to memory of 2284 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4888 wrote to memory of 2284 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4888 wrote to memory of 2284 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4888 wrote to memory of 2284 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 4888 wrote to memory of 2284 4888 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe PID 2284 wrote to memory of 1596 2284 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe svchost.exe PID 2284 wrote to memory of 1596 2284 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe svchost.exe PID 2284 wrote to memory of 1916 2284 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe calc.exe PID 2284 wrote to memory of 1916 2284 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe calc.exe PID 2284 wrote to memory of 2576 2284 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe mspaint.exe PID 2284 wrote to memory of 2576 2284 b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe mspaint.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe"C:\Users\Admin\AppData\Local\Temp\b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe"C:\Users\Admin\AppData\Local\Temp\b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\calc.exe"C:\Windows\SysWOW64\calc.exe"3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exe"C:\Windows\SysWOW64\svchost.exe"3⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mspaint.exe"C:\Windows\SysWOW64\mspaint.exe"4⤵
- Adds Run key to start application
- Enumerates connected drives
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe"C:\Users\Admin\AppData\Local\Temp\b73518f4d0d5e0f3ac262335ae4715f4f54f91f623a6de74c2ef1326754b6c39.exe"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1596-149-0x0000000000A10000-0x0000000000A39000-memory.dmpFilesize
164KB
-
memory/1596-153-0x0000000000A50000-0x0000000000A9E000-memory.dmpFilesize
312KB
-
memory/1596-136-0x0000000000000000-mapping.dmp
-
memory/1916-154-0x00000000021A0000-0x00000000021EE000-memory.dmpFilesize
312KB
-
memory/1916-137-0x0000000000000000-mapping.dmp
-
memory/2284-143-0x0000000000000000-mapping.dmp
-
memory/2284-152-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2284-151-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2284-148-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2284-146-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2284-144-0x0000000000400000-0x000000000044E000-memory.dmpFilesize
312KB
-
memory/2576-140-0x0000000000EF0000-0x0000000000F19000-memory.dmpFilesize
164KB
-
memory/2576-141-0x0000000000EF0000-0x0000000000F19000-memory.dmpFilesize
164KB
-
memory/2576-138-0x0000000000000000-mapping.dmp
-
memory/2576-150-0x0000000000EF0000-0x0000000000F19000-memory.dmpFilesize
164KB
-
memory/2576-142-0x0000000000EF0000-0x0000000000F19000-memory.dmpFilesize
164KB
-
memory/2576-139-0x0000000000EF0000-0x0000000000F19000-memory.dmpFilesize
164KB
-
memory/2576-155-0x0000000000F30000-0x0000000000F7E000-memory.dmpFilesize
312KB
-
memory/2576-156-0x0000000000F30000-0x0000000000F7E000-memory.dmpFilesize
312KB
-
memory/4888-132-0x0000000000000000-mapping.dmp
-
memory/4888-147-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4888-133-0x0000000000400000-0x0000000000429000-memory.dmpFilesize
164KB
-
memory/4912-135-0x0000000002170000-0x000000000218A000-memory.dmpFilesize
104KB