Analysis
-
max time kernel
141s -
max time network
157s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
27/11/2022, 18:45
Static task
static1
Behavioral task
behavioral1
Sample
7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe
Resource
win10v2004-20220901-en
General
-
Target
7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe
-
Size
134KB
-
MD5
153b6e4a6bc57ebc7354384464735267
-
SHA1
4943cae6751b0ab46340255450c3579f4d4811b7
-
SHA256
7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91
-
SHA512
9e9e034112dfbe0fe10644b84ad0aac1593356ed7002d90d68f0d9853e1882f5197b23014c9d93963863f26856c2ec43b1ec801cb3dddd24ccb9b0a3c26de4be
-
SSDEEP
1536:yU15UBD4c3NlVU64c6cbwe0xoERHr3A61/dtUvWcmSDX3HVi7uVghbeGu9oeP47:51l22oERDA6pg+cmSL3HCuVgGob
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\18001 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\ccijabbva.exe" svchost.exe -
Executes dropped EXE 1 IoCs
pid Process 4184 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 920 set thread context of 4184 920 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe 81 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\ccijabbva.exe svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4184 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe 4184 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 920 wrote to memory of 4184 920 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe 81 PID 920 wrote to memory of 4184 920 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe 81 PID 920 wrote to memory of 4184 920 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe 81 PID 920 wrote to memory of 4184 920 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe 81 PID 920 wrote to memory of 4184 920 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe 81 PID 920 wrote to memory of 4184 920 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe 81 PID 4184 wrote to memory of 4388 4184 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe 82 PID 4184 wrote to memory of 4388 4184 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe 82 PID 4184 wrote to memory of 4388 4184 7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe 82
Processes
-
C:\Users\Admin\AppData\Local\Temp\7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe"C:\Users\Admin\AppData\Local\Temp\7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Users\Admin\AppData\Local\Temp\7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe"C:\Users\Admin\AppData\Local\Temp\7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\syswow64\svchost.exe3⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
PID:4388
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\7cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91.exe
Filesize134KB
MD5153b6e4a6bc57ebc7354384464735267
SHA14943cae6751b0ab46340255450c3579f4d4811b7
SHA2567cf5f2afeaccadc75331198d185b39407b057cc20d3230605fcd0d3ceecedf91
SHA5129e9e034112dfbe0fe10644b84ad0aac1593356ed7002d90d68f0d9853e1882f5197b23014c9d93963863f26856c2ec43b1ec801cb3dddd24ccb9b0a3c26de4be