Analysis
-
max time kernel
151s -
max time network
207s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 03:09
Static task
static1
Behavioral task
behavioral1
Sample
eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe
Resource
win7-20221111-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe
-
Size
74KB
-
MD5
ceec27f098443ee5677839b6049c59b6
-
SHA1
575b328b87adb232560fb5b247b22db99d339369
-
SHA256
eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21
-
SHA512
b98ef75c5e5e9603deb2a6ffb04a067ffde36f4f8b40f7d8eeef0bc831f95fc69bdc0ebed3f175755e06778862d3c77f516ecf421da0528acf6eefcd13cc0bb5
-
SSDEEP
768:Wn3SBAdJ22b2xpj3wnyaX6+RjUuQdTM9cHdx/s6hw9Loy4IX7tGjg4xz8tBHVIlQ:wSBAbp28LYdRsG5F8H1Iemgh3QGf
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini = "C:\\Windows\\system32\\userini.exe" eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\policies\Explorer\Run eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\userini = "C:\\Windows\\system32\\userini.exe" eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\userini = "C:\\Windows\\system32\\userini.exe" eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\run eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\userini = "C:\\Windows\\system32\\userini.exe" eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\run eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\userini.exe eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\explorer.exe:userini.exe eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe -
NTFS ADS 1 IoCs
description ioc Process File created C:\Windows\explorer.exe:userini.exe eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe -
Suspicious behavior: MapViewOfSection 21 IoCs
pid Process 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 884 wrote to memory of 368 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 24 PID 884 wrote to memory of 368 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 24 PID 884 wrote to memory of 368 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 24 PID 884 wrote to memory of 368 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 24 PID 884 wrote to memory of 368 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 24 PID 884 wrote to memory of 368 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 24 PID 884 wrote to memory of 368 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 24 PID 884 wrote to memory of 384 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 23 PID 884 wrote to memory of 384 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 23 PID 884 wrote to memory of 384 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 23 PID 884 wrote to memory of 384 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 23 PID 884 wrote to memory of 384 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 23 PID 884 wrote to memory of 384 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 23 PID 884 wrote to memory of 384 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 23 PID 884 wrote to memory of 420 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 3 PID 884 wrote to memory of 420 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 3 PID 884 wrote to memory of 420 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 3 PID 884 wrote to memory of 420 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 3 PID 884 wrote to memory of 420 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 3 PID 884 wrote to memory of 420 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 3 PID 884 wrote to memory of 420 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 3 PID 884 wrote to memory of 464 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 2 PID 884 wrote to memory of 464 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 2 PID 884 wrote to memory of 464 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 2 PID 884 wrote to memory of 464 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 2 PID 884 wrote to memory of 464 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 2 PID 884 wrote to memory of 464 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 2 PID 884 wrote to memory of 464 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 2 PID 884 wrote to memory of 480 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 1 PID 884 wrote to memory of 480 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 1 PID 884 wrote to memory of 480 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 1 PID 884 wrote to memory of 480 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 1 PID 884 wrote to memory of 480 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 1 PID 884 wrote to memory of 480 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 1 PID 884 wrote to memory of 480 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 1 PID 884 wrote to memory of 488 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 22 PID 884 wrote to memory of 488 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 22 PID 884 wrote to memory of 488 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 22 PID 884 wrote to memory of 488 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 22 PID 884 wrote to memory of 488 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 22 PID 884 wrote to memory of 488 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 22 PID 884 wrote to memory of 488 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 22 PID 884 wrote to memory of 580 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 21 PID 884 wrote to memory of 580 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 21 PID 884 wrote to memory of 580 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 21 PID 884 wrote to memory of 580 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 21 PID 884 wrote to memory of 580 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 21 PID 884 wrote to memory of 580 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 21 PID 884 wrote to memory of 580 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 21 PID 884 wrote to memory of 660 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 20 PID 884 wrote to memory of 660 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 20 PID 884 wrote to memory of 660 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 20 PID 884 wrote to memory of 660 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 20 PID 884 wrote to memory of 660 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 20 PID 884 wrote to memory of 660 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 20 PID 884 wrote to memory of 660 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 20 PID 884 wrote to memory of 748 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 19 PID 884 wrote to memory of 748 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 19 PID 884 wrote to memory of 748 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 19 PID 884 wrote to memory of 748 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 19 PID 884 wrote to memory of 748 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 19 PID 884 wrote to memory of 748 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 19 PID 884 wrote to memory of 748 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 19 PID 884 wrote to memory of 796 884 eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe 18
Processes
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:480
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:464
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1032
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1064
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:484
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1124
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:324
-
C:\Windows\system32\wininit.exewininit.exe3⤵PID:368
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:276
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵PID:864
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:840
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:796
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵PID:748
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:660
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:580
-
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:420
-
\\?\C:\Windows\system32\wbem\WMIADAP.EXEwmiadap.exe /F /T /R1⤵PID:1980
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1264
-
C:\Users\Admin\AppData\Local\Temp\eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe"C:\Users\Admin\AppData\Local\Temp\eefa8252cf1a139a1d9af9cbdc4d265c688ace8d107971c1a8ae34ca9f2b1f21.exe"2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Drops file in System32 directory
- Drops file in Windows directory
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:884
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:488
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵PID:384