Analysis
-
max time kernel
68s -
max time network
91s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
04/12/2022, 12:47
Static task
static1
Behavioral task
behavioral1
Sample
e9e5d02e19222ab0a702707ceea6608e3a056e9e0be29ad35dce0a34089cac7e.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
e9e5d02e19222ab0a702707ceea6608e3a056e9e0be29ad35dce0a34089cac7e.exe
Resource
win10v2004-20221111-en
Errors
General
-
Target
e9e5d02e19222ab0a702707ceea6608e3a056e9e0be29ad35dce0a34089cac7e.exe
-
Size
96KB
-
MD5
11c57a6258216254623b2a0fbc75a79c
-
SHA1
af5b4a018b5c49e533be60951dbedbb8e5d4fc59
-
SHA256
e9e5d02e19222ab0a702707ceea6608e3a056e9e0be29ad35dce0a34089cac7e
-
SHA512
48788a8c70e5002ad3a2b981d091863711ec7b86cb55dd6d3badbe0181b73bf38f74d05e3828f9ec7777a6946ad8311e46c30c3feec97ed1a6e3690ea50ab46c
-
SSDEEP
1536:x10WMWy/r8LB26iuw1rUVJg66ppPJLX6YkG/NajokBgmQB:x1BMzALBpirAPN6ppPZKs/MjoSgmQ
Malware Config
Signatures
-
Modifies AppInit DLL entries 2 TTPs
-
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\yexwell.dll e9e5d02e19222ab0a702707ceea6608e3a056e9e0be29ad35dce0a34089cac7e.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 956 e9e5d02e19222ab0a702707ceea6608e3a056e9e0be29ad35dce0a34089cac7e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e9e5d02e19222ab0a702707ceea6608e3a056e9e0be29ad35dce0a34089cac7e.exe"C:\Users\Admin\AppData\Local\Temp\e9e5d02e19222ab0a702707ceea6608e3a056e9e0be29ad35dce0a34089cac7e.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
PID:956
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1052
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:820