Analysis
-
max time kernel
187s -
max time network
191s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06/12/2022, 15:44
Static task
static1
Behavioral task
behavioral1
Sample
9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe
Resource
win10v2004-20221111-en
General
-
Target
9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe
-
Size
376KB
-
MD5
708c4d11c0e0c68e3694d527fc86951a
-
SHA1
2cc880b2265dbca3b57308a747f654c1c110fd88
-
SHA256
9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d
-
SHA512
798f086a9cc6564f50a9c6bca860c035657f77296da3b1475368dd6797f9ba8b278df50829701c6e34d58c688bb81fe4fea51949c88ed987792ea805658042bb
-
SSDEEP
6144:DpZbPT3pqObP5F9uqJjLnGRwjG9XPR2rIttqg6EdguFA7fP8dqufOy/:D7rT3pFRF9TJjL0wjG9fR2Mjj6eHQVuN
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1788 gD01605GmMkC01605.exe -
resource yara_rule behavioral2/memory/1720-133-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral2/memory/1720-134-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral2/memory/1788-138-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral2/memory/1788-139-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral2/memory/1720-140-0x0000000000400000-0x00000000004C3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\gD01605GmMkC01605 = "C:\\gD01605GmMkC01605\\gD01605GmMkC01605.exe" gD01605GmMkC01605.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe Token: SeDebugPrivilege 1788 gD01605GmMkC01605.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1788 gD01605GmMkC01605.exe 1788 gD01605GmMkC01605.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1788 gD01605GmMkC01605.exe 1788 gD01605GmMkC01605.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1720 wrote to memory of 1788 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 83 PID 1720 wrote to memory of 1788 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 83 PID 1720 wrote to memory of 1788 1720 9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe"C:\Users\Admin\AppData\Local\Temp\9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\gD01605GmMkC01605\gD01605GmMkC01605.exe"\gD01605GmMkC01605\gD01605GmMkC01605.exe" "C:\Users\Admin\AppData\Local\Temp\9d34326c4c0d350898acd6fe6423effcd83e89986046ebc6ba7dd4ae77dc181d.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1788
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 388 -p 1720 -ip 17201⤵PID:3836
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 468 -p 1788 -ip 17881⤵PID:2160
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
376KB
MD5f58fd9a274f094e02cb6e588fb0dffd6
SHA14ecad54a474c9d4e6b65600eca3d14a8dc55a200
SHA256a8f77a5053122dc5c0b620bc3b5c51d6ae8d451f3e852b91a1ec19ca3d663726
SHA5128cf4d78307784b40e0bcfcf8fe01cac9d5cc045e4ed4a45c74f653d089ccfb325c5558b5a3db30bb8f2ec1d2634d0bc47770cd3fc52ead2a2a964fbb6b23021b
-
Filesize
376KB
MD5f58fd9a274f094e02cb6e588fb0dffd6
SHA14ecad54a474c9d4e6b65600eca3d14a8dc55a200
SHA256a8f77a5053122dc5c0b620bc3b5c51d6ae8d451f3e852b91a1ec19ca3d663726
SHA5128cf4d78307784b40e0bcfcf8fe01cac9d5cc045e4ed4a45c74f653d089ccfb325c5558b5a3db30bb8f2ec1d2634d0bc47770cd3fc52ead2a2a964fbb6b23021b