9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a

Analysis

max time kernel
36s
max time network
41s
platform
windows7_x64
resource
win7-20220812-en
resource tags

arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 11:25

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe
Size

34KB
MD5

33cc6acf45f1a9eaa6dc1677ed9ee535
SHA1

a68c6a328920a2fb273144997a9f4e9435a4240a
SHA256

9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a
SHA512

75567cc47df8a4a54130c748a329483ad951561a9841e19b77ff7f22f74792df72e7557adcda72e767f85bb8b73a3d5de36fb0889aa593f048d1e3c8df13f112
SSDEEP

768:aYZ9TjWPV75tw0Km5tS5k850NIq8h8zy1ARkrXgAmL5sToj:HT6Pfm0KmCkO8muRkrXwL5sT

Score

8^/10

persistence upx

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\msupdate\ImagePath = "c:\\windows\\system32\\mssrv32.exe"	svchost.exe

UPX packed file 2 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1672-54-0x0000000015110000-0x0000000015151000-memory.dmp	upx
behavioral1/files/0x0007000000005c50-64.dat	upx

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	\??\c:\windows\SysWOW64\mssrv32.exe	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe
File opened for modification	\??\c:\windows\SysWOW64\mssrv32.exe	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 696 set thread context of 984	696	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe	28

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	1672	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe

Suspicious use of WriteProcessMemory 9 IoCs

description	pid	Process	procid_target
PID 1672 wrote to memory of 696	1672	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe	27
PID 1672 wrote to memory of 696	1672	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe	27
PID 1672 wrote to memory of 696	1672	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe	27
PID 1672 wrote to memory of 696	1672	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe	27
PID 696 wrote to memory of 984	696	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe	28
PID 696 wrote to memory of 984	696	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe	28
PID 696 wrote to memory of 984	696	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe	28
PID 696 wrote to memory of 984	696	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe	28
PID 696 wrote to memory of 984	696	9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe	28

C:\Users\Admin\AppData\Local\Temp\9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe
"C:\Users\Admin\AppData\Local\Temp\9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe"
1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672
- \??\c:\users\admin\appdata\local\temp\9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe
  c:\users\admin\appdata\local\temp\9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a.exe
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:696
- - C:\Windows\SysWOW64\svchost.exe
    C:\Windows\system32\svchost.exe
    3⤵
    - Sets service image path in registry
    PID:984

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\??\c:\windows\SysWOW64\mssrv32.exe

Filesize
34KB

MD5
33cc6acf45f1a9eaa6dc1677ed9ee535

SHA1
a68c6a328920a2fb273144997a9f4e9435a4240a

SHA256
9a7633ff8ae872358f1942d1869b0788e69da97e7c7e976dab54067181dc523a

SHA512
75567cc47df8a4a54130c748a329483ad951561a9841e19b77ff7f22f74792df72e7557adcda72e767f85bb8b73a3d5de36fb0889aa593f048d1e3c8df13f112

Download Submit
memory/696-63-0x0000000015110000-0x0000000015151000-memory.dmp

Filesize
260KB

Download
memory/984-59-0x0000000015110000-0x0000000015119000-memory.dmp

Filesize
36KB

Download
memory/984-65-0x0000000075BD1000-0x0000000075BD3000-memory.dmp

Filesize
8KB

Download
memory/984-66-0x0000000015110000-0x0000000015119000-memory.dmp

Filesize
36KB

Download
memory/984-67-0x0000000015110000-0x0000000015119000-memory.dmp

Filesize
36KB

Download
memory/1672-54-0x0000000015110000-0x0000000015151000-memory.dmp

Filesize
260KB

Download
memory/1672-55-0x00000000001C0000-0x00000000001C4000-memory.dmp

Filesize
16KB

Download
memory/1672-57-0x0000000015110000-0x0000000015151000-memory.dmp

Filesize
260KB

Download
memory/1672-58-0x0000000001E50000-0x0000000001E91000-memory.dmp

Filesize
260KB

Download