Analysis
-
max time kernel
87s -
max time network
111s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-11-2022 07:05
Behavioral task
behavioral1
Sample
804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe
Resource
win7-20220812-en
windows7-x64
5 signatures
150 seconds
General
-
Target
804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe
-
Size
400KB
-
MD5
ea48a9ca64f7418365b9604aa7a97aeb
-
SHA1
795340a02494d3ff0406e5139fa4027189912676
-
SHA256
804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78
-
SHA512
e04b7eb4e10bdf4f8babbae1439f6a78e6e8721bb7c47301eafe1a5e410abdf8bf604aa89db53409eba2a76bacd6f636a77169e15f4b73106eadaa3cee00f7ac
-
SSDEEP
6144:HJqr5L3BT9qj8tfRlIgVVu+z1J+x3DdHO2kju9m8nlm96+igw:HJ03BBFdXrj53+ZRHOvjumclnxB
Malware Config
Signatures
-
Drops file in Drivers directory 64 IoCs
Processes:
804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exedescription ioc process File opened for modification C:\Windows\system32\drivers\msiscsi.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\mpio.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\MTConfig.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\vmbus.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\Drivers\BrUsbMdm.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\fdc.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\serial.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\uagp35.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\umpass.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\amdsata.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\drivers\tcpipreg.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\drivers\volmgrx.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\hidir.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\irenum.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\lsi_sas2.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\DRIVERS\scfilter.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\Drivers\secdrv.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\usbohci.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\USBSTOR.SYS 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\VMBusHID.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\adpu320.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\arcsas.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\lsi_fc.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\MSTEE.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\serenum.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\tsusbhub.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\DRIVERS\rspndr.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\processr.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\drivers\rdpdr.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\usbprint.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\wd.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\drivers\discache.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\DRIVERS\netbt.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\Drivers\BrSerWdm.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\drivers\dxgkrnl.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\hcw85cir.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\drivers\mshidkmdf.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\bxvbda.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\pciide.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\SiSRaid2.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\elxstor.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\errdev.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\hidbth.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\1394ohci.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\bthmodem.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\HpSAMD.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\tdtcp.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\agp440.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\MSPQM.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\pcmcia.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\vms3cap.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\DRIVERS\lltdio.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\dmvsc.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\flpydisk.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\iirsp.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\MSPCLOCK.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\Drivers\spldr.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\tsusbflt.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\appid.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\evbda.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\modem.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\nv_agp.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\system32\drivers\WudfPf.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe File opened for modification C:\Windows\System32\Drivers\NDProxy.sys 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe -
Processes:
resource yara_rule behavioral1/memory/916-54-0x0000000000400000-0x00000000004AA000-memory.dmp vmprotect behavioral1/memory/916-57-0x0000000000400000-0x00000000004AA000-memory.dmp vmprotect -
Processes:
804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe -
Processes:
804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Internet Explorer\Main 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exepid process 916 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe 916 804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe"C:\Users\Admin\AppData\Local\Temp\804c907fc99134e018d6fcb4371b65826633c0184f8976fe4a24d19803203d78.exe"1⤵
- Drops file in Drivers directory
- Checks whether UAC is enabled
- Modifies Internet Explorer settings
- Suspicious use of SetWindowsHookEx