Analysis
-
max time kernel
153s -
max time network
160s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
04-12-2022 13:38
Static task
static1
Behavioral task
behavioral1
Sample
e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
18 signatures
150 seconds
General
-
Target
e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe
-
Size
174KB
-
MD5
c064b8cabf4f3aae85b422b3798833c2
-
SHA1
35249dfe2329712e104e7d436cd7ae1646f0e3b1
-
SHA256
e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da
-
SHA512
b6c1854a42e6fc9524c127be72e342cc3b0d06e21e915af3b291ad9d2d28f9266b52622d92b5b93d26900ffd3b64c264313ff108b7b631aec3d216a7b1054cb4
-
SSDEEP
3072:pbY1rwlmzqhTwuSyDgolzRBA/W2fXX8GCkMLBaNDeINg0jns/6HQFhs9d0:ps1MCgNSyDXRt2fNCkhexSs1Q
Score
10/10
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
resource yara_rule behavioral1/memory/844-56-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral1/memory/1644-64-0x0000000000400000-0x0000000000452000-memory.dmp upx behavioral1/memory/852-68-0x0000000000400000-0x0000000000452000-memory.dmp upx -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\05F.exe = "C:\\Program Files (x86)\\LP\\6E50\\05F.exe" e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe -
Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\6E50\05F.exe e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe File opened for modification C:\Program Files (x86)\LP\6E50\5AC.tmp e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe File opened for modification C:\Program Files (x86)\LP\6E50\05F.exe e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1604 explorer.exe -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeRestorePrivilege 952 msiexec.exe Token: SeTakeOwnershipPrivilege 952 msiexec.exe Token: SeSecurityPrivilege 952 msiexec.exe Token: SeShutdownPrivilege 1604 explorer.exe Token: SeShutdownPrivilege 1604 explorer.exe Token: SeShutdownPrivilege 1604 explorer.exe Token: SeShutdownPrivilege 1604 explorer.exe Token: SeShutdownPrivilege 1604 explorer.exe Token: SeShutdownPrivilege 1604 explorer.exe Token: SeShutdownPrivilege 1604 explorer.exe Token: SeShutdownPrivilege 1604 explorer.exe Token: SeShutdownPrivilege 1604 explorer.exe Token: SeShutdownPrivilege 1604 explorer.exe Token: 33 868 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 868 AUDIODG.EXE Token: 33 868 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 868 AUDIODG.EXE Token: SeShutdownPrivilege 1604 explorer.exe Token: SeShutdownPrivilege 1604 explorer.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe -
Suspicious use of SendNotifyMessage 21 IoCs
pid Process 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe 1604 explorer.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 844 wrote to memory of 1644 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 32 PID 844 wrote to memory of 1644 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 32 PID 844 wrote to memory of 1644 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 32 PID 844 wrote to memory of 1644 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 32 PID 844 wrote to memory of 852 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 34 PID 844 wrote to memory of 852 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 34 PID 844 wrote to memory of 852 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 34 PID 844 wrote to memory of 852 844 e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe 34 -
System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe"C:\Users\Admin\AppData\Local\Temp\e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe"1⤵
- Modifies security service
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:844 -
C:\Users\Admin\AppData\Local\Temp\e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exeC:\Users\Admin\AppData\Local\Temp\e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe startC:\Users\Admin\AppData\Roaming\0EEAF\4A26E.exe%C:\Users\Admin\AppData\Roaming\0EEAF2⤵PID:1644
-
-
C:\Users\Admin\AppData\Local\Temp\e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exeC:\Users\Admin\AppData\Local\Temp\e2a3a5eba29af906a304798585db2ecab401a7661f500e53c2b00eec6cdb48da.exe startC:\Program Files (x86)\AF18D\lvvm.exe%C:\Program Files (x86)\AF18D2⤵PID:852
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:952
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1604
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5901⤵
- Suspicious use of AdjustPrivilegeToken
PID:868