Analysis
-
max time kernel
152s -
max time network
57s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 22:04
Static task
static1
Behavioral task
behavioral1
Sample
83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe
-
Size
96KB
-
MD5
984eacc08e0dde07b56b7d5cb986ed77
-
SHA1
4f59fec6c55630fc8e80548a9b96ae912aaabaed
-
SHA256
83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085
-
SHA512
64b7db9645aae194d07cbfdf2a065d00f5a0a6298e6adc56325eb71d86aaf6367dc03120ab0badf544033ae75c768cfbbbbaae0b204423918b6acb84c928a866
-
SSDEEP
1536:5FCKOporQUwJ5LaXOZAUJW7V3mRMTsTlngrQmBv:PCKOporQWX17tzv
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe,C:\\Users\\Admin\\AppData\\Roaming\\msconfig.dat" svchost.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 1728 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 1312 explorer.exe 1288 Explorer.EXE 1708 svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1588 set thread context of 1728 1588 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 27 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1728 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 1728 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe 1708 svchost.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 1728 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 1728 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 1288 Explorer.EXE -
Suspicious use of FindShellTrayWindow 7 IoCs
pid Process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1900 ctfmon.exe 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SendNotifyMessage 3 IoCs
pid Process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1708 svchost.exe 1708 svchost.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 1588 wrote to memory of 1728 1588 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 27 PID 1588 wrote to memory of 1728 1588 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 27 PID 1588 wrote to memory of 1728 1588 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 27 PID 1588 wrote to memory of 1728 1588 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 27 PID 1588 wrote to memory of 1728 1588 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 27 PID 1588 wrote to memory of 1728 1588 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 27 PID 1588 wrote to memory of 1728 1588 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 27 PID 1588 wrote to memory of 1728 1588 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 27 PID 1588 wrote to memory of 1728 1588 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 27 PID 1728 wrote to memory of 1312 1728 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 28 PID 1728 wrote to memory of 1312 1728 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 28 PID 1728 wrote to memory of 1312 1728 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 28 PID 1728 wrote to memory of 1312 1728 83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe 28 PID 1312 wrote to memory of 1288 1312 explorer.exe 15 PID 1288 wrote to memory of 1708 1288 Explorer.EXE 29 PID 1288 wrote to memory of 1708 1288 Explorer.EXE 29 PID 1288 wrote to memory of 1708 1288 Explorer.EXE 29 PID 1288 wrote to memory of 1708 1288 Explorer.EXE 29 PID 1288 wrote to memory of 1708 1288 Explorer.EXE 29 PID 1708 wrote to memory of 1900 1708 svchost.exe 30 PID 1708 wrote to memory of 1900 1708 svchost.exe 30 PID 1708 wrote to memory of 1900 1708 svchost.exe 30 PID 1708 wrote to memory of 1900 1708 svchost.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe"C:\Users\Admin\AppData\Local\Temp\83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1588 -
C:\Users\Admin\AppData\Local\Temp\83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe"C:\Users\Admin\AppData\Local\Temp\83f177b7f245e91a14b25e7ebdd551c3db016538667409c1a3987dba91906085.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1728 -
C:\Windows\explorer.exe"C:\Windows\explorer.exe"3⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of WriteProcessMemory
PID:1312
-
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:1288 -
C:\Windows\syswow64\svchost.exe"C:\Windows\syswow64\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\ctfmon.exectfmon.exe3⤵
- Suspicious use of FindShellTrayWindow
PID:1900
-
-