Analysis
-
max time kernel
149s -
max time network
159s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-12-2022 10:40
Static task
static1
Behavioral task
behavioral1
Sample
b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe
-
Size
1.0MB
-
MD5
c1531d22af6f9310a33649b65c59e268
-
SHA1
76e1a348db1020570d9bb2bc5b10c07a1b476080
-
SHA256
b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f
-
SHA512
ee382b37bfc27474e3bb8853fd8092b8171f50e5037e67ee10fb20df6b59b4ad3aa1167a77c6740123f3e2d3644a884837076f4c0e8627d0c898aa2302ec8e95
-
SSDEEP
12288:pb7RLI78pE/m4L9RnYJMP1cfQArt7k7TSEnozTYGbTB4NsM2PEaCxQoXjGblg+Ez:dk/mjuRu7yPo4iCz8Se6
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Louzz.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Louzz.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Louzz = "C:\\Users\\Admin\\AppData\\Roaming\\Louzz.exe" b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5B0319D1-ABCF-203A-E6DA-ECDBCBAEB4C9} b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{5B0319D1-ABCF-203A-E6DA-ECDBCBAEB4C9}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Louzz.exe" b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{5B0319D1-ABCF-203A-E6DA-ECDBCBAEB4C9} b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Active Setup\Installed Components\{5B0319D1-ABCF-203A-E6DA-ECDBCBAEB4C9}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Louzz.exe" b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe -
resource yara_rule behavioral1/memory/896-56-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/896-60-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/896-61-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/896-76-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/896-77-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Louzz = "C:\\Users\\Admin\\AppData\\Roaming\\Louzz.exe" b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Key created \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\Louzz = "C:\\Users\\Admin\\AppData\\Roaming\\Louzz.exe" b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 1208 set thread context of 896 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 27 PID 1208 set thread context of 0 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1872 reg.exe 320 reg.exe 972 reg.exe 1416 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeCreateTokenPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeAssignPrimaryTokenPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeLockMemoryPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeIncreaseQuotaPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeMachineAccountPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeTcbPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeSecurityPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeTakeOwnershipPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeLoadDriverPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeSystemProfilePrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeSystemtimePrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeProfSingleProcessPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeIncBasePriorityPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeCreatePagefilePrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeCreatePermanentPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeBackupPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeRestorePrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeShutdownPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeDebugPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeAuditPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeSystemEnvironmentPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeChangeNotifyPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeRemoteShutdownPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeUndockPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeSyncAgentPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeEnableDelegationPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeManageVolumePrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeImpersonatePrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeCreateGlobalPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: 31 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: 32 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: 33 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: 34 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: 35 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe Token: SeDebugPrivilege 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe -
Suspicious use of WriteProcessMemory 46 IoCs
description pid Process procid_target PID 1208 wrote to memory of 896 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 27 PID 1208 wrote to memory of 896 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 27 PID 1208 wrote to memory of 896 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 27 PID 1208 wrote to memory of 896 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 27 PID 1208 wrote to memory of 896 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 27 PID 1208 wrote to memory of 896 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 27 PID 1208 wrote to memory of 896 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 27 PID 1208 wrote to memory of 896 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 27 PID 1208 wrote to memory of 896 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 27 PID 1208 wrote to memory of 0 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe PID 1208 wrote to memory of 0 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe PID 1208 wrote to memory of 0 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe PID 1208 wrote to memory of 0 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe PID 1208 wrote to memory of 0 1208 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe PID 896 wrote to memory of 1988 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 28 PID 896 wrote to memory of 1988 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 28 PID 896 wrote to memory of 1988 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 28 PID 896 wrote to memory of 1988 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 28 PID 896 wrote to memory of 2028 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 30 PID 896 wrote to memory of 2028 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 30 PID 896 wrote to memory of 2028 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 30 PID 896 wrote to memory of 2028 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 30 PID 896 wrote to memory of 1744 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 32 PID 896 wrote to memory of 1744 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 32 PID 896 wrote to memory of 1744 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 32 PID 896 wrote to memory of 1744 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 32 PID 896 wrote to memory of 1924 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 33 PID 896 wrote to memory of 1924 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 33 PID 896 wrote to memory of 1924 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 33 PID 896 wrote to memory of 1924 896 b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe 33 PID 1988 wrote to memory of 320 1988 cmd.exe 37 PID 1988 wrote to memory of 320 1988 cmd.exe 37 PID 1988 wrote to memory of 320 1988 cmd.exe 37 PID 1988 wrote to memory of 320 1988 cmd.exe 37 PID 2028 wrote to memory of 972 2028 cmd.exe 38 PID 2028 wrote to memory of 972 2028 cmd.exe 38 PID 2028 wrote to memory of 972 2028 cmd.exe 38 PID 2028 wrote to memory of 972 2028 cmd.exe 38 PID 1744 wrote to memory of 1872 1744 cmd.exe 36 PID 1744 wrote to memory of 1872 1744 cmd.exe 36 PID 1744 wrote to memory of 1872 1744 cmd.exe 36 PID 1744 wrote to memory of 1872 1744 cmd.exe 36 PID 1924 wrote to memory of 1416 1924 cmd.exe 39 PID 1924 wrote to memory of 1416 1924 cmd.exe 39 PID 1924 wrote to memory of 1416 1924 cmd.exe 39 PID 1924 wrote to memory of 1416 1924 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe"C:\Users\Admin\AppData\Local\Temp\b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1208 -
C:\Users\Admin\AppData\Local\Temp\b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe"C:\Users\Admin\AppData\Local\Temp\b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:896 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:320
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b7a3050ee603440fdf8a865319342f65f6c93983e998ca700e6852d32f05270f.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:972
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1872
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Louzz.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Louzz.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1924 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Louzz.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Louzz.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1416
-
-
-