Analysis
-
max time kernel
78s -
max time network
52s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
05/12/2022, 11:21
Static task
static1
Behavioral task
behavioral1
Sample
9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe
Resource
win10v2004-20220812-en
General
-
Target
9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe
-
Size
243KB
-
MD5
a2e621cb7630d1eb95839242b92d92b5
-
SHA1
6afdf66253e6cfad74ec6c308e848a9434afe490
-
SHA256
9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435
-
SHA512
fbaeb2d0e933d0e7cc74dc7217f5f73f384429931e4e6bc5495bc5751f7f75f47513de2bb72faf4c813ca7678473042e64b005814a7090c68a73021916aea232
-
SSDEEP
6144:+PhHaosPOvb27I91wkpzPQ/d45JCxlZd4izCW5rRhg26:+PhgPOvb27SJm45OOizCW5N6
Malware Config
Signatures
-
Disables taskbar notifications via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 1624 sbu.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
resource yara_rule behavioral1/memory/948-68-0x0000000000400000-0x00000000004F1000-memory.dmp upx behavioral1/memory/948-73-0x0000000000400000-0x00000000004F1000-memory.dmp upx behavioral1/memory/1624-88-0x0000000000400000-0x00000000004F1000-memory.dmp upx -
Deletes itself 1 IoCs
pid Process 1624 sbu.exe -
Loads dropped DLL 2 IoCs
pid Process 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 660 explorer.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 660 explorer.exe Token: SeShutdownPrivilege 660 explorer.exe Token: SeShutdownPrivilege 660 explorer.exe Token: SeShutdownPrivilege 660 explorer.exe Token: SeShutdownPrivilege 660 explorer.exe Token: SeShutdownPrivilege 660 explorer.exe Token: SeShutdownPrivilege 660 explorer.exe Token: SeShutdownPrivilege 660 explorer.exe Token: SeShutdownPrivilege 660 explorer.exe Token: SeShutdownPrivilege 660 explorer.exe Token: 33 1984 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1984 AUDIODG.EXE Token: 33 1984 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1984 AUDIODG.EXE Token: SeShutdownPrivilege 660 explorer.exe Token: SeShutdownPrivilege 660 explorer.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe 660 explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 948 wrote to memory of 1624 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 27 PID 948 wrote to memory of 1624 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 27 PID 948 wrote to memory of 1624 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 27 PID 948 wrote to memory of 1624 948 9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe"C:\Users\Admin\AppData\Local\Temp\9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Users\Admin\AppData\Local\sbu.exe"C:\Users\Admin\AppData\Local\sbu.exe" -gav C:\Users\Admin\AppData\Local\Temp\9ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435.exe2⤵
- Executes dropped EXE
- Deletes itself
PID:1624
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:660
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5841⤵
- Suspicious use of AdjustPrivilegeToken
PID:1984
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
243KB
MD5a2e621cb7630d1eb95839242b92d92b5
SHA16afdf66253e6cfad74ec6c308e848a9434afe490
SHA2569ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435
SHA512fbaeb2d0e933d0e7cc74dc7217f5f73f384429931e4e6bc5495bc5751f7f75f47513de2bb72faf4c813ca7678473042e64b005814a7090c68a73021916aea232
-
Filesize
243KB
MD5a2e621cb7630d1eb95839242b92d92b5
SHA16afdf66253e6cfad74ec6c308e848a9434afe490
SHA2569ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435
SHA512fbaeb2d0e933d0e7cc74dc7217f5f73f384429931e4e6bc5495bc5751f7f75f47513de2bb72faf4c813ca7678473042e64b005814a7090c68a73021916aea232
-
Filesize
243KB
MD5a2e621cb7630d1eb95839242b92d92b5
SHA16afdf66253e6cfad74ec6c308e848a9434afe490
SHA2569ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435
SHA512fbaeb2d0e933d0e7cc74dc7217f5f73f384429931e4e6bc5495bc5751f7f75f47513de2bb72faf4c813ca7678473042e64b005814a7090c68a73021916aea232
-
Filesize
243KB
MD5a2e621cb7630d1eb95839242b92d92b5
SHA16afdf66253e6cfad74ec6c308e848a9434afe490
SHA2569ae90d2165742dd6786670e664d6b92cf9fa54b1971a67dcc6d4bae5dba22435
SHA512fbaeb2d0e933d0e7cc74dc7217f5f73f384429931e4e6bc5495bc5751f7f75f47513de2bb72faf4c813ca7678473042e64b005814a7090c68a73021916aea232