Analysis
- max time kernel
138s - max time network
123s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
29/01/2023, 08:31
Static task
static1
Behavioral task
behavioral1
Sample
be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe
Resource
win7-20220812-en
windows7-x64
20 signatures
150 seconds
General
- Target be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe
- Size 284KB
- Sample230129-keregaff74
- SHA256 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0
- MD5 303756a5a7ec3b8ce61c8be6386cd699
- SHA1 362898d2d0a999603c08fb3f2e89f3080271bf4f
- SHA512 e865b1079575e25a915076a85456fbd71e0caed94614f4b93f800b3f71bbace64b06c5aac587b8a330529f631d70b0687b0b90c6d3dbae214caffb8210c8957f
- SSDEEP 6144:9v/IgVsPjo82vLrkKbGi6qzXQs7c4pDkHKHKWVGANCs5FGWO0:JGjo8UrbGnqzJv1YKHK3AgmC
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe - Disables taskbar notifications via registry modification
- Executes dropped EXE 1 IoCs
pid Process 1300 D579.tmp - Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
resource yara_rule behavioral1/memory/1076-55-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1076-59-0x0000000000400000-0x000000000046A000-memory.dmp upx behavioral1/memory/1784-69-0x0000000000400000-0x000000000046A000-memory.dmp upx - Loads dropped DLL 2 IoCs
pid Process 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\3F8.exe = "C:\\Program Files (x86)\\LP\\A513\\3F8.exe" be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\A513\3F8.exe be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe File opened for modification C:\Program Files (x86)\LP\A513\D579.tmp be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe File opened for modification C:\Program Files (x86)\LP\A513\3F8.exe be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 288 explorer.exe - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeRestorePrivilege 1816 msiexec.exe Token: SeTakeOwnershipPrivilege 1816 msiexec.exe Token: SeSecurityPrivilege 1816 msiexec.exe Token: SeShutdownPrivilege 288 explorer.exe Token: SeShutdownPrivilege 288 explorer.exe Token: SeShutdownPrivilege 288 explorer.exe Token: SeShutdownPrivilege 288 explorer.exe Token: SeShutdownPrivilege 288 explorer.exe Token: SeShutdownPrivilege 288 explorer.exe Token: SeShutdownPrivilege 288 explorer.exe Token: SeShutdownPrivilege 288 explorer.exe Token: SeShutdownPrivilege 288 explorer.exe Token: SeShutdownPrivilege 288 explorer.exe Token: 33 1952 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1952 AUDIODG.EXE Token: 33 1952 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1952 AUDIODG.EXE Token: SeShutdownPrivilege 288 explorer.exe Token: SeShutdownPrivilege 288 explorer.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe - Suspicious use of SendNotifyMessage 17 IoCs
pid Process 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe 288 explorer.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1076 wrote to memory of 296 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 28 PID 1076 wrote to memory of 296 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 28 PID 1076 wrote to memory of 296 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 28 PID 1076 wrote to memory of 296 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 28 PID 1076 wrote to memory of 1784 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 33 PID 1076 wrote to memory of 1784 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 33 PID 1076 wrote to memory of 1784 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 33 PID 1076 wrote to memory of 1784 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 33 PID 1076 wrote to memory of 1300 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 34 PID 1076 wrote to memory of 1300 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 34 PID 1076 wrote to memory of 1300 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 34 PID 1076 wrote to memory of 1300 1076 be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe 34 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe"C:\Users\Admin\AppData\Local\Temp\be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1076 -
C:\Users\Admin\AppData\Local\Temp\be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exeC:\Users\Admin\AppData\Local\Temp\be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe startC:\Users\Admin\AppData\Roaming\31B96\C7EA5.exe%C:\Users\Admin\AppData\Roaming\31B962⤵PID:296
-
-
C:\Users\Admin\AppData\Local\Temp\be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exeC:\Users\Admin\AppData\Local\Temp\be5c55c1a70c165ce868f26ba7a0a878153055d32b56d8448345ccdecc2b8fb0.exe startC:\Program Files (x86)\96551\lvvm.exe%C:\Program Files (x86)\965512⤵PID:1784
-
-
C:\Program Files (x86)\LP\A513\D579.tmp"C:\Program Files (x86)\LP\A513\D579.tmp"2⤵
- Executes dropped EXE
PID:1300
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1816
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:288
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5a01⤵
- Suspicious use of AdjustPrivilegeToken
PID:1952
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\LP\A513\D579.tmp
- Size 101KB
- SHA256 7315bbc1d631338fffeeec3edb5d64bb6d050c9f390da8bdc7714806b8966eaa
- MD5 c28186290b51a5350bfc382685940af4
- SHA1 dcc9eb2a2375f81dfb98515c07912ad4028216be
- SHA512 a94b534cb518097e2b89718bc70c77a9c1c8cc43c302e547b02cf1bad0bbc7cd6bc9bb42dd19823c3cd90389057dc3df62f7c03b7e42066cf49563c86cbdf7e7
- SSDEEP 3072:95xZ75nPgA6O91PDWRRonrgTnJQfPP85pO:DxF5nPb6OT7minreJQ6pO
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\LP\A513\D579.tmp
- Size 101KB
- SHA256 7315bbc1d631338fffeeec3edb5d64bb6d050c9f390da8bdc7714806b8966eaa
- MD5 c28186290b51a5350bfc382685940af4
- SHA1 dcc9eb2a2375f81dfb98515c07912ad4028216be
- SHA512 a94b534cb518097e2b89718bc70c77a9c1c8cc43c302e547b02cf1bad0bbc7cd6bc9bb42dd19823c3cd90389057dc3df62f7c03b7e42066cf49563c86cbdf7e7
- SSDEEP 3072:95xZ75nPgA6O91PDWRRonrgTnJQfPP85pO:DxF5nPb6OT7minreJQ6pO
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\LP\A513\D579.tmp
- Size 101KB
- SHA256 7315bbc1d631338fffeeec3edb5d64bb6d050c9f390da8bdc7714806b8966eaa
- MD5 c28186290b51a5350bfc382685940af4
- SHA1 dcc9eb2a2375f81dfb98515c07912ad4028216be
- SHA512 a94b534cb518097e2b89718bc70c77a9c1c8cc43c302e547b02cf1bad0bbc7cd6bc9bb42dd19823c3cd90389057dc3df62f7c03b7e42066cf49563c86cbdf7e7
- SSDEEP 3072:95xZ75nPgA6O91PDWRRonrgTnJQfPP85pO:DxF5nPb6OT7minreJQ6pO
- MD5 SHA1 SHA512 SSDEEP