Analysis
-
max time kernel
149s -
max time network
182s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 04:27
Static task
static1
Behavioral task
behavioral1
Sample
615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe
Resource
win7-20220812-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe
-
Size
31KB
-
MD5
f54ffdd60c09ffb3f4efb9471e358351
-
SHA1
3f22fa7af70163aa95a913a2b8f54be3c050e3eb
-
SHA256
615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750
-
SHA512
7063ab54cba15832924104ad50343dbfaf6ca642d907a54db5d1f02112fe4f5aaa723c86495721a9ca77b92149c1b35c4951a03427ca1af0830a6f4715197ac9
-
SSDEEP
768:D62nHocW3Tkcow+H63qv9wcLmCdocsyJAjFNjYRj+RKp5nbcuyD7U4lGuWC:D68oc6kzw+H6uBL9docfKYRjdnouy84t
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe -
Stops running service(s) 3 TTPs
-
Loads dropped DLL 1 IoCs
pid Process 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\360se = "C:\\Users\\Admin\\AppData\\Local\\Temp\\615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe" 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe -
Enumerates connected drives 3 TTPs 22 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\t: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\u: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\n: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\w: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\x: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\g: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\h: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\l: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\m: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\p: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\s: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\y: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\z: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\e: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\f: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\i: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\j: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\k: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\o: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\q: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\r: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened (read-only) \??\v: 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\7108216.DEP 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\rgdltecq\oioifz.pif 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe File opened for modification C:\Program Files (x86)\Common Files\rgdltecq\oioifz.pif 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe -
Launches sc.exe 1 IoCs
Sc.exe is a Windows utlilty to control services on the system.
pid Process 1768 sc.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe Token: SeDebugPrivilege 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1952 wrote to memory of 2040 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 28 PID 1952 wrote to memory of 2040 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 28 PID 1952 wrote to memory of 2040 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 28 PID 1952 wrote to memory of 2040 1952 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe 28 PID 2040 wrote to memory of 1768 2040 cmd.exe 30 PID 2040 wrote to memory of 1768 2040 cmd.exe 30 PID 2040 wrote to memory of 1768 2040 cmd.exe 30 PID 2040 wrote to memory of 1768 2040 cmd.exe 30 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe"C:\Users\Admin\AppData\Local\Temp\615eb4d58c212957c7153c90426d24c611f3324a210a916f7c7cf247ddc69750.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1952 -
C:\Windows\SysWOW64\cmd.execmd /c sc stop policyagent2⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\sc.exesc stop policyagent3⤵
- Launches sc.exe
PID:1768
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.1MB
MD54b9e356eac342aa2583bb618b38a99d7
SHA195303c3d71f6d0dcc4d7f048af3aff64c3be18e5
SHA2563b4e389948ff809b2c87d36a379c4513dfb845e3ca17bd5b44aa445175689c97
SHA51258b08ed58768486aaaf61268f66994e8d3b2f76239aa37b213ecccbda7a28735620fcff08cc1169626afc2dac6901d2d5fb3cf4a0f8a7c77a9c1d8f8f173a066