Analysis
-
max time kernel
107s -
max time network
54s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 07:59
Static task
static1
Behavioral task
behavioral1
Sample
b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe
-
Size
210KB
-
MD5
4c5d1c893cd1eb108856879721723ac7
-
SHA1
1a343410bc51ad84191a386ec9ebe2c5e355ea06
-
SHA256
b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f
-
SHA512
c21f875b2735576ea0155b5dccce4bf93b01cda3720590285c8d40ed069f439d57d9a931de1f1034f0f895440be08ec7ada2d8558e47acb35522963fd1abc44b
-
SSDEEP
3072:b7UIcXW+7hjgwOFSCQJULOx+kZlvxR399i3Wy39M4elFtWN+BlZBJ96vFgZVvJVK:E5W+7hkuv9dyNgLt6+BFHIyOn
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Loads dropped DLL 1 IoCs
pid Process 1788 b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe -
Drops file in System32 directory 9 IoCs
description ioc Process File created C:\Windows\SysWOW64\cnvfak.ocx b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe File opened for modification C:\Windows\SysWOW64\rastlmr.dat b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe File opened for modification C:\Windows\SysWOW64\iasyusqh.dat b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe File opened for modification C:\Windows\SysWOW64\msdaatk.dat b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe File opened for modification C:\Windows\SysWOW64\cnvfak.dat b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe File created C:\Windows\SysWOW64\cnvfak.dat b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe File created C:\Windows\SysWOW64\rastlmr.dat b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe File created C:\Windows\SysWOW64\iasyusqh.dat b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe File created C:\Windows\SysWOW64\msdaatk.dat b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe -
Modifies registry class 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD28BF9F-6C3A-7674-941E-E0F031CDBC3B}\ = "cnvfak" b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD28BF9F-6C3A-7674-941E-E0F031CDBC3B}\InprocServer32\ = "C:\\Windows\\SysWow64\\cnvfak.ocx" b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Wow6432Node\CLSID\{BD28BF9F-6C3A-7674-941E-E0F031CDBC3B} b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD28BF9F-6C3A-7674-941E-E0F031CDBC3B}\InprocServer32 b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{BD28BF9F-6C3A-7674-941E-E0F031CDBC3B}\InprocServer32\ThreadingModel = "Apartment" b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe Set value (data) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2028 explorer.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeShutdownPrivilege 2028 explorer.exe Token: SeShutdownPrivilege 2028 explorer.exe Token: SeShutdownPrivilege 2028 explorer.exe Token: SeShutdownPrivilege 2028 explorer.exe Token: SeShutdownPrivilege 2028 explorer.exe Token: SeShutdownPrivilege 2028 explorer.exe Token: SeShutdownPrivilege 2028 explorer.exe Token: SeShutdownPrivilege 2028 explorer.exe Token: SeShutdownPrivilege 2028 explorer.exe Token: SeShutdownPrivilege 2028 explorer.exe Token: 33 776 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 776 AUDIODG.EXE Token: 33 776 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 776 AUDIODG.EXE Token: SeShutdownPrivilege 2028 explorer.exe Token: SeShutdownPrivilege 2028 explorer.exe -
Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe 2028 explorer.exe -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1788 b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe"C:\Users\Admin\AppData\Local\Temp\b7486d6bd6de845028f746326679ddb1d941f5fe53fb784d31d88bb8e9b58c9f.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of UnmapMainImage
PID:1788
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2028
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5941⤵
- Suspicious use of AdjustPrivilegeToken
PID:776
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
165KB
MD5c7d7eca1b6043fdf4eab112ace0d922a
SHA1c049d26483c75917ec16ba1be23fd263667ec752
SHA256d2a6c333db399e2dfbf25db2abda5ebf35c1e34fa2be271163954bf8980b1750
SHA512ed6dce07b4de3e41b3bc0e5b3fe9b8bf7da4ea1aaf2c51e38b4b928e267849d6fe644290059f2d6824b6ce0c978c39bd2306138dfa75fb791a12d0c8889d0691