Analysis
-
max time kernel
11s -
max time network
31s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 04:14
Behavioral task
behavioral1
Sample
33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe
Resource
win7-20221111-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe
-
Size
180KB
-
MD5
108969d1e7dd55cb81384c5e6139f990
-
SHA1
0596ab0eeb4f880aad7df8211adc8bfa8ccd5bc9
-
SHA256
33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c
-
SHA512
265d756b77a8fc4f7e7bfbe982ba9f107bdf95dd923b66df19b67b86c0cdc657cfc38768deac3ff75063f0ab4bf9f7ce0ae573738e558f85c137de1dda4c621d
-
SSDEEP
3072:AHU7nDrBZyoLiGQv8XQRJg2D4oCdnDxCZ5ZkYa2mA9FWLqt2a0GG40e+:Wur3y6iJv8XQ/g4cDxI5ba2mA9FWra0x
Score
10/10
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files (x86)\\LFENE.EXE \"%1\" %*" 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe -
resource yara_rule behavioral1/memory/1724-54-0x0000000000400000-0x0000000000478000-memory.dmp upx behavioral1/memory/1724-55-0x0000000000400000-0x0000000000478000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LFENE.EXE = "C:\\Program Files (x86)\\LFENE.EXE" 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe -
Enumerates connected drives 3 TTPs 18 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\P: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\E: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\G: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\J: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\M: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\N: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\S: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\T: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\V: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\H: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\Q: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\R: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\F: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\I: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\K: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\L: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened (read-only) \??\U: 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files\XVNB.EXE 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File created C:\Program Files (x86)\LFENE.EXE 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe File opened for modification C:\Program Files (x86)\LFENE.EXE 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe -
Modifies registry class 14 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Program Files\\XVNB.EXE %1" 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\Program Files (x86)\\LFENE.EXE \"%1\"" 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Program Files (x86)\\LFENE.EXE \"%1\" %*" 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\Program Files (x86)\\LFENE.EXE \"%1\"" 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\Program Files (x86)\\LFENE.EXE %1" 33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe"C:\Users\Admin\AppData\Local\Temp\33696e2763c9616b40e824e88460f95d42ae8b24830a16cce84224afd8380f9c.exe"1⤵
- Modifies system executable filetype association
- Adds Run key to start application
- Enumerates connected drives
- Drops file in Program Files directory
- Modifies registry class
PID:1724