Analysis
-
max time kernel
151s -
max time network
171s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 09:53
Static task
static1
Behavioral task
behavioral1
Sample
34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe
-
Size
304KB
-
MD5
c9f92c20679ca187a0bf947b7f2f411b
-
SHA1
1792f63523605cf4ee832bbdd065885f9267c321
-
SHA256
34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733
-
SHA512
f70bbcb89535b193c1a99d2ac9807338e46d2f0122c7d6169384fc8c113ba342e1a09b13d91602f5673d8d3f573f05ce89308b980983d7e0ccb2b1c9fa315691
-
SSDEEP
6144:jAu/uehexajvyac1YKY+8/iNoC8r6axpu4+pVRo8X1/1:jAu/uCexajaL1ciWvuxVRo8lN
Score
10/10
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 17 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\fxc.exe\" -a \"%1\" %*" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\DefaultIcon fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\runas fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\runas\command fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\start fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\start\command fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\ = "Application" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\Content Type = "application/x-msdownload" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\DefaultIcon\ = "%1" fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" fxc.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 844 fxc.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
pid Process 844 fxc.exe -
Loads dropped DLL 2 IoCs
pid Process 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\WINDOWS\\system32\\ctfmon.exe" fxc.exe -
Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\DefaultIcon fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\start\command\IsolatedCommand = "\"%1\" %*" fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\ = "Application" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\Content Type = "application/x-msdownload" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\start\command fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\open fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\open\command fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\runas\command fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\runas fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\DefaultIcon fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\fxc.exe\" -a \"%1\" %*" fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\DefaultIcon\ = "%1" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\start\command fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\runas\command fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\start fxc.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\ = "exefile" fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\fxc.exe\" -a \"%1\" %*" fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\Content Type = "application/x-msdownload" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\start fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\start\command\ = "\"%1\" %*" fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" fxc.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\.exe\shell\runas fxc.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\exefile\DefaultIcon\ = "%1" fxc.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 844 fxc.exe 844 fxc.exe 844 fxc.exe 844 fxc.exe 844 fxc.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: 33 1748 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1748 AUDIODG.EXE Token: 33 1748 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1748 AUDIODG.EXE Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe Token: SeShutdownPrivilege 1252 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 844 fxc.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 844 fxc.exe 1252 explorer.exe 1252 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
pid Process 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 1252 explorer.exe 844 fxc.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1724 wrote to memory of 844 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 27 PID 1724 wrote to memory of 844 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 27 PID 1724 wrote to memory of 844 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 27 PID 1724 wrote to memory of 844 1724 34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe"C:\Users\Admin\AppData\Local\Temp\34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1724 -
C:\Users\Admin\AppData\Local\fxc.exe"C:\Users\Admin\AppData\Local\fxc.exe" -gav C:\Users\Admin\AppData\Local\Temp\34190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733.exe2⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:844
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1252
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5781⤵
- Suspicious use of AdjustPrivilegeToken
PID:1748
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
304KB
MD5c9f92c20679ca187a0bf947b7f2f411b
SHA11792f63523605cf4ee832bbdd065885f9267c321
SHA25634190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733
SHA512f70bbcb89535b193c1a99d2ac9807338e46d2f0122c7d6169384fc8c113ba342e1a09b13d91602f5673d8d3f573f05ce89308b980983d7e0ccb2b1c9fa315691
-
Filesize
304KB
MD5c9f92c20679ca187a0bf947b7f2f411b
SHA11792f63523605cf4ee832bbdd065885f9267c321
SHA25634190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733
SHA512f70bbcb89535b193c1a99d2ac9807338e46d2f0122c7d6169384fc8c113ba342e1a09b13d91602f5673d8d3f573f05ce89308b980983d7e0ccb2b1c9fa315691
-
Filesize
304KB
MD5c9f92c20679ca187a0bf947b7f2f411b
SHA11792f63523605cf4ee832bbdd065885f9267c321
SHA25634190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733
SHA512f70bbcb89535b193c1a99d2ac9807338e46d2f0122c7d6169384fc8c113ba342e1a09b13d91602f5673d8d3f573f05ce89308b980983d7e0ccb2b1c9fa315691
-
Filesize
304KB
MD5c9f92c20679ca187a0bf947b7f2f411b
SHA11792f63523605cf4ee832bbdd065885f9267c321
SHA25634190b62697ce9059282f218b0d2c060b5bdf08e8cff1739d75d763ed3323733
SHA512f70bbcb89535b193c1a99d2ac9807338e46d2f0122c7d6169384fc8c113ba342e1a09b13d91602f5673d8d3f573f05ce89308b980983d7e0ccb2b1c9fa315691