Analysis
-
max time kernel
35s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 10:06
Static task
static1
Behavioral task
behavioral1
Sample
c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe
-
Size
140KB
-
MD5
c4fc57f44b8fffd09f4886ef10b25b47
-
SHA1
b782f6fb6422ef51e4f853908e59686e8aa18827
-
SHA256
c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21
-
SHA512
3bdb47060e4bd9cc9c18fddc28f4f8ac3b40444ed55f73d00741ecdf6a1ff241166fe4ff2f59c721d8ce3434529c56ade66a2260d689cd89cdb941b7b170a944
-
SSDEEP
3072:GfWeOCUfINP/3lbFZBF2uJJoTzwnPTdBEX58z22pveQouvwttK:Gi5INn3lbFZCuaQsp8z22YQouvwtt
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe c:\\windows\\system32\\mgq.exe" c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe c:\\windows\\system32\\mgq.exe" c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe c:\\windows\\system32\\mgq.exe" mgq.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe c:\\windows\\system32\\mgq.exe" mgq.exe -
Modifies firewall policy service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" mgq.exe -
Executes dropped EXE 1 IoCs
pid Process 980 mgq.exe -
Loads dropped DLL 2 IoCs
pid Process 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\SettingUpd = "c:\\users\\admin\\appdata\\local\\temp\\c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe" c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\SettingUpd = "c:\\users\\admin\\appdata\\local\\temp\\c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe" c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification \??\c:\windows\SysWOW64\mgq.exe c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe File created \??\c:\windows\SysWOW64\mgq.exe c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 980 mgq.exe 980 mgq.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 872 wrote to memory of 980 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 27 PID 872 wrote to memory of 980 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 27 PID 872 wrote to memory of 980 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 27 PID 872 wrote to memory of 980 872 c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe"C:\Users\Admin\AppData\Local\Temp\c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21.exe"1⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:872 -
\??\c:\windows\SysWOW64\mgq.exec:\windows\system32\mgq.exe2⤵
- Modifies WinLogon for persistence
- Modifies firewall policy service
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
PID:980
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
140KB
MD5c4fc57f44b8fffd09f4886ef10b25b47
SHA1b782f6fb6422ef51e4f853908e59686e8aa18827
SHA256c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21
SHA5123bdb47060e4bd9cc9c18fddc28f4f8ac3b40444ed55f73d00741ecdf6a1ff241166fe4ff2f59c721d8ce3434529c56ade66a2260d689cd89cdb941b7b170a944
-
Filesize
140KB
MD5c4fc57f44b8fffd09f4886ef10b25b47
SHA1b782f6fb6422ef51e4f853908e59686e8aa18827
SHA256c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21
SHA5123bdb47060e4bd9cc9c18fddc28f4f8ac3b40444ed55f73d00741ecdf6a1ff241166fe4ff2f59c721d8ce3434529c56ade66a2260d689cd89cdb941b7b170a944
-
Filesize
140KB
MD5c4fc57f44b8fffd09f4886ef10b25b47
SHA1b782f6fb6422ef51e4f853908e59686e8aa18827
SHA256c78bb81ccd2d4faa4572e74960952854fa06f7e934aa3a966937a018fbc88a21
SHA5123bdb47060e4bd9cc9c18fddc28f4f8ac3b40444ed55f73d00741ecdf6a1ff241166fe4ff2f59c721d8ce3434529c56ade66a2260d689cd89cdb941b7b170a944