Analysis
-
max time kernel
166s -
max time network
176s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
29-11-2022 10:18
Static task
static1
Behavioral task
behavioral1
Sample
aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe
Resource
win7-20221111-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe
-
Size
109KB
-
MD5
2d6464f50d78647d533ee3cd2009003d
-
SHA1
2254cd9b598d469bc0bd6ba9d87e7216ecd4c662
-
SHA256
aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921
-
SHA512
17c51cee013fa3218e35f96a214afc84b358883e1436199dd170aa222dbc1300a197615639e48d95b463bef4a9fed246e31c036597d2ab4dd42a01e605e9697e
-
SSDEEP
3072:s/+kaOA1i1F7CfTnfJwyExidyX8NF1OZuoT+yUT7PoV/:tB1i1qnf+jfOLQV+yUT7QV/
Score
8/10
Malware Config
Signatures
-
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe -
Modifies AppInit DLL entries 2 TTPs
-
resource yara_rule behavioral2/files/0x001b00000001d9f9-135.dat vmprotect behavioral2/files/0x001b00000001d9f9-134.dat vmprotect -
Loads dropped DLL 1 IoCs
pid Process 1268 rundll32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Disker = "rundll32.exe C:\\Windows\\system32\\HIMYM.DLL,DW" rundll32.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\HIMYM.DLL aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe Token: SeDebugPrivilege 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2684 wrote to memory of 1268 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 79 PID 2684 wrote to memory of 1268 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 79 PID 2684 wrote to memory of 1268 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 79 PID 2684 wrote to memory of 4208 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 80 PID 2684 wrote to memory of 4208 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 80 PID 2684 wrote to memory of 4208 2684 aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe"C:\Users\Admin\AppData\Local\Temp\aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe"1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2684 -
C:\Windows\SysWOW64\rundll32.exeC:\Windows\system32\rundll32.exe C:\Windows\system32\HIMYM.DLL,DW2⤵
- Loads dropped DLL
- Adds Run key to start application
PID:1268
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del "C:\Users\Admin\AppData\Local\Temp\aa7e25c7a93aef3592f0dbcc617be1d8cb3b4fcb72f3b563080105b19aa6e921.exe"2⤵PID:4208
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
92KB
MD5bfcc0ea64d04c72d2ac74b91866ff4de
SHA1886ef0198e02499922ea5b3784d30c6833579999
SHA256f3fae8b0f07bea756696ea23c659b604d8a1d308fca6a6275c6d06efd70a3ed9
SHA512e67ce6f10c37d0b32d378dbf6566fe55223bf43f690879be60f7dc1b8bea621f34ad0c31ed92245edbf1caebc5d1df280ae17aa9119decb7ff0458eed9891538
-
Filesize
92KB
MD5bfcc0ea64d04c72d2ac74b91866ff4de
SHA1886ef0198e02499922ea5b3784d30c6833579999
SHA256f3fae8b0f07bea756696ea23c659b604d8a1d308fca6a6275c6d06efd70a3ed9
SHA512e67ce6f10c37d0b32d378dbf6566fe55223bf43f690879be60f7dc1b8bea621f34ad0c31ed92245edbf1caebc5d1df280ae17aa9119decb7ff0458eed9891538