Analysis
-
max time kernel
151s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 03:12
Static task
static1
Behavioral task
behavioral1
Sample
aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe
-
Size
95KB
-
MD5
46d57ee6cecfba14ae3f30f3732da149
-
SHA1
a2cf4cb9ba0922e540fdd64d4c7aa131b5883a1b
-
SHA256
aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8
-
SHA512
41ff8222218557749415280200593f0cd507e54d52cab45dc337513adf67d25d7971a23ec6c2d1523af8507d67af125ebe3d081cf0255cee386cf96f5774ed20
-
SSDEEP
1536:bU2FvPyRtETKKF07CqF44jmF8A7FVHoGMpYvCGYw4gGsIQ8/5xLanTmRvzoQ7z+w:FnTmRbP7zP5WvY
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\msconfig.dat" svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 1212 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 1528 explorer.exe 1276 Explorer.EXE 1708 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1468 set thread context of 1212 1468 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 28 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1212 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 1212 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1212 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 1212 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE 956 ctfmon.exe 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1276 Explorer.EXE 1276 Explorer.EXE 1276 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1708 svchost.exe 1708 svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1468 wrote to memory of 1212 1468 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 28 PID 1468 wrote to memory of 1212 1468 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 28 PID 1468 wrote to memory of 1212 1468 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 28 PID 1468 wrote to memory of 1212 1468 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 28 PID 1468 wrote to memory of 1212 1468 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 28 PID 1468 wrote to memory of 1212 1468 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 28 PID 1468 wrote to memory of 1212 1468 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 28 PID 1468 wrote to memory of 1212 1468 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 28 PID 1468 wrote to memory of 1212 1468 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 28 PID 1212 wrote to memory of 1528 1212 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 29 PID 1212 wrote to memory of 1528 1212 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 29 PID 1212 wrote to memory of 1528 1212 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 29 PID 1212 wrote to memory of 1528 1212 aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe 29 PID 1528 wrote to memory of 1276 1528 explorer.exe 11 PID 1276 wrote to memory of 1708 1276 Explorer.EXE 30 PID 1276 wrote to memory of 1708 1276 Explorer.EXE 30 PID 1276 wrote to memory of 1708 1276 Explorer.EXE 30 PID 1276 wrote to memory of 1708 1276 Explorer.EXE 30 PID 1276 wrote to memory of 1708 1276 Explorer.EXE 30 PID 1708 wrote to memory of 956 1708 svchost.exe 31 PID 1708 wrote to memory of 956 1708 svchost.exe 31 PID 1708 wrote to memory of 956 1708 svchost.exe 31 PID 1708 wrote to memory of 956 1708 svchost.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe"C:\Users\Admin\AppData\Local\Temp\aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Users\Admin\AppData\Local\Temp\aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe"C:\Users\Admin\AppData\Local\Temp\aec8bf4dc1b94e23b894e5583e3aaa40ffb81058f5d143068df2afd7dae8b0d8.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1528
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1276 -
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe3⤵
- Suspicious use of FindShellTrayWindow
PID:956
-
-