92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d

Analysis

max time kernel
129s
max time network
137s
platform
windows7_x64
resource
win7-20221111-en
resource tags

arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
submitted
05/12/2022, 12:20

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Size

148KB
MD5

05639b8124b0351afd81622bd60dfc4b
SHA1

822798e5681c3ffb38fc082c769b3c93544605b3
SHA256

92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d
SHA512

b8b2616b520e307b99b60e4b992406a2ded6a893c5ff316d067529a538905e5cce4cef1121c5d2feb981046a78685469e955f1cef70d746411f2dfd4dd63cb2b
SSDEEP

1536:LwmYBwCBH5nW0Sg7iA0L5CgN1FSiDrNWuYoe3AuC:LwwCBHEEUL5CgF9DpWuh3uC

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1640	dsncb.exe

UPX packed file 8 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/996-55-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x001b00000001249b-56.dat	upx
behavioral1/files/0x001b00000001249b-57.dat	upx
behavioral1/files/0x001b00000001249b-59.dat	upx
behavioral1/memory/1640-63-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/memory/996-67-0x0000000000400000-0x000000000042E000-memory.dmp	upx
behavioral1/files/0x001b00000001249b-68.dat	upx
behavioral1/memory/1640-71-0x0000000000400000-0x000000000042E000-memory.dmp	upx

Deletes itself 1 IoCs

pid	Process
1324	cmd.exe

Loads dropped DLL 2 IoCs

pid	Process
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe

Enumerates connected drives 3 TTPs 4 IoCs

Attempts to read the root path of hard drives other than the default C: drive.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
File opened (read-only)	\??\F:	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
File opened (read-only)	\??\E:	dsncb.exe
File opened (read-only)	\??\F:	dsncb.exe
File opened (read-only)	\??\E:	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\dsncb.exe	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
File created	C:\Windows\SysWOW64\dsncb.exe	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
File opened for modification	C:\Windows\SysWOW64\dsncb.exe	dsncb.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe

Suspicious use of AdjustPrivilegeToken 12 IoCs

description	pid	Process
Token: SeBackupPrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Token: SeRestorePrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Token: SeRestorePrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Token: SeRestorePrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Token: SeRestorePrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Token: SeRestorePrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Token: SeBackupPrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Token: SeRestorePrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Token: SeRestorePrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Token: SeRestorePrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Token: SeRestorePrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
Token: SeRestorePrivilege	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 996 wrote to memory of 1640	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe	30
PID 996 wrote to memory of 1640	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe	30
PID 996 wrote to memory of 1640	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe	30
PID 996 wrote to memory of 1640	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe	30
PID 996 wrote to memory of 1324	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe	32
PID 996 wrote to memory of 1324	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe	32
PID 996 wrote to memory of 1324	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe	32
PID 996 wrote to memory of 1324	996	92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe	32
PID 1640 wrote to memory of 1004	1640	dsncb.exe	34
PID 1640 wrote to memory of 1004	1640	dsncb.exe	34
PID 1640 wrote to memory of 1004	1640	dsncb.exe	34
PID 1640 wrote to memory of 1004	1640	dsncb.exe	34

C:\Users\Admin\AppData\Local\Temp\92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe
"C:\Users\Admin\AppData\Local\Temp\92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d.exe"
1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:996
- C:\Windows\SysWOW64\dsncb.exe
  C:\Windows\system32\dsncb.exe
  2⤵
  - Executes dropped EXE
  - Enumerates connected drives
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1640
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c C:\Users\Admin\AppData\Local\Temp\~vgsh!.BAt
    3⤵
    PID:1004
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Users\Admin\AppData\Local\Temp\~qbbb!.BAt
  2⤵
  - Deletes itself
  PID:1324

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~qbbb!.BAt

Filesize
278B

MD5
b71bf74bc99a9d5641cb238d8a527480

SHA1
83b9c9d9841ce2a7ef064958772dce35dd7a79d6

SHA256
908fae8bf349bff2605a7106027752a357068170c286160ef3439805bec48119

SHA512
50de4bcca3d03bc67cab89b1ba506c77d507633f75275faa953eeb38935c7fd27aaaf2c240d8b56d52807fe8de2dc1cbdc6d0e603dc91f13a2fda2a1951fe60d

Download Submit
C:\Users\Admin\AppData\Local\Temp\~vgsh!.BAt

Filesize
132B

MD5
67c497d7a886468e561a36926da6f5ad

SHA1
7611980fa7650e63c71291b28970378af44d7098

SHA256
4c59f64c595a05d0823ace64912c5f80f90ba748339c0d408e8308573b9432a8

SHA512
af3182bd0cc398f5bc7bd8d74dc20d7eb2f09f974a5520bcb3bc525750e0ee9c6b3fb91ccabb3d4a15c6b4e9a0aab599363f0a028ac6e749fe260009ed08819e

Download Submit
C:\Windows\SysWOW64\dsncb.exe

Filesize
148KB

MD5
05639b8124b0351afd81622bd60dfc4b

SHA1
822798e5681c3ffb38fc082c769b3c93544605b3

SHA256
92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d

SHA512
b8b2616b520e307b99b60e4b992406a2ded6a893c5ff316d067529a538905e5cce4cef1121c5d2feb981046a78685469e955f1cef70d746411f2dfd4dd63cb2b

Download Submit
C:\Windows\SysWOW64\dsncb.exe

Filesize
148KB

MD5
05639b8124b0351afd81622bd60dfc4b

SHA1
822798e5681c3ffb38fc082c769b3c93544605b3

SHA256
92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d

SHA512
b8b2616b520e307b99b60e4b992406a2ded6a893c5ff316d067529a538905e5cce4cef1121c5d2feb981046a78685469e955f1cef70d746411f2dfd4dd63cb2b

Download Submit
\Windows\SysWOW64\dsncb.exe

Filesize
148KB

MD5
05639b8124b0351afd81622bd60dfc4b

SHA1
822798e5681c3ffb38fc082c769b3c93544605b3

SHA256
92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d

SHA512
b8b2616b520e307b99b60e4b992406a2ded6a893c5ff316d067529a538905e5cce4cef1121c5d2feb981046a78685469e955f1cef70d746411f2dfd4dd63cb2b

Download Submit
\Windows\SysWOW64\dsncb.exe

Filesize
148KB

MD5
05639b8124b0351afd81622bd60dfc4b

SHA1
822798e5681c3ffb38fc082c769b3c93544605b3

SHA256
92d730f1e8aa6dc9511fdcae70e5eb042ea89eae92b53d6bfcd1e22c9991a84d

SHA512
b8b2616b520e307b99b60e4b992406a2ded6a893c5ff316d067529a538905e5cce4cef1121c5d2feb981046a78685469e955f1cef70d746411f2dfd4dd63cb2b

Download Submit
memory/996-67-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/996-62-0x00000000024C0000-0x00000000024EE000-memory.dmp

Filesize
184KB

Download
memory/996-64-0x00000000024C0000-0x00000000024EE000-memory.dmp

Filesize
184KB

Download
memory/996-61-0x00000000024C0000-0x00000000024EE000-memory.dmp

Filesize
184KB

Download
memory/996-54-0x0000000075291000-0x0000000075293000-memory.dmp

Filesize
8KB

Download
memory/996-55-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1640-63-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download
memory/1640-71-0x0000000000400000-0x000000000042E000-memory.dmp

Filesize
184KB

Download