Analysis
-
max time kernel
196s -
max time network
211s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
30-11-2022 19:14
Static task
static1
Behavioral task
behavioral1
Sample
6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe
Resource
win7-20221111-en
General
-
Target
6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe
-
Size
1.3MB
-
MD5
2261fa3658c9ff2e8c6a47728303afda
-
SHA1
e9d2ead2ad2f69fe7354121213e6bac2759b7ebf
-
SHA256
6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda
-
SHA512
592758f325777ab3459783efbfab44c517665892ffad2ff6fe3b18d51155847222954d68b69c898e18c228172d7b1ac89f7152e533a6718b922f6bfa91271329
-
SSDEEP
24576:2AHnh+eWsN3skA4RV1Hom2KXFmIaF9ClJTEMW5HLAUUeSWK/pLQQvZsTY5:Rh+ZkldoPK1Xavyi3OWOpLxq6
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
RegSvcs.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DSL Manager = "C:\\Program Files (x86)\\DSL Manager\\dslmgr.exe" RegSvcs.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exedescription pid process target process PID 112 set thread context of 4332 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe RegSvcs.exe -
Drops file in Program Files directory 2 IoCs
Processes:
RegSvcs.exedescription ioc process File created C:\Program Files (x86)\DSL Manager\dslmgr.exe RegSvcs.exe File opened for modification C:\Program Files (x86)\DSL Manager\dslmgr.exe RegSvcs.exe -
Suspicious behavior: EnumeratesProcesses 29 IoCs
Processes:
6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exeRegSvcs.exepid process 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 4332 RegSvcs.exe 4332 RegSvcs.exe 4332 RegSvcs.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
RegSvcs.exepid process 4332 RegSvcs.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exepid process 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
RegSvcs.exedescription pid process Token: SeDebugPrivilege 4332 RegSvcs.exe -
Suspicious use of FindShellTrayWindow 3 IoCs
Processes:
6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exepid process 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe -
Suspicious use of SendNotifyMessage 3 IoCs
Processes:
6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exepid process 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exedescription pid process target process PID 112 wrote to memory of 4332 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe RegSvcs.exe PID 112 wrote to memory of 4332 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe RegSvcs.exe PID 112 wrote to memory of 4332 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe RegSvcs.exe PID 112 wrote to memory of 4332 112 6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe RegSvcs.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe"C:\Users\Admin\AppData\Local\Temp\6e31d3c7f81d01c9c84a625addf6c20d8ceaeda797564021e8ffb0038a47bfda.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegSvcs.exe"2⤵
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/112-133-0x0000000000D50000-0x0000000000E0F000-memory.dmpFilesize
764KB
-
memory/112-134-0x0000000000D50000-0x0000000000E0F000-memory.dmpFilesize
764KB
-
memory/4332-132-0x0000000000000000-mapping.dmp
-
memory/4332-135-0x0000000074190000-0x0000000074741000-memory.dmpFilesize
5.7MB
-
memory/4332-136-0x0000000074190000-0x0000000074741000-memory.dmpFilesize
5.7MB