Analysis
-
max time kernel
151s -
max time network
161s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
29-01-2023 13:40
Behavioral task
behavioral1
Sample
9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe
Resource
win10v2004-20220812-en
General
-
Target
9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe
-
Size
138KB
-
MD5
fa060f23e51febba321e0d1fc9bfa8cd
-
SHA1
d0fa04ae2778037bc6ef107eaac86ed7ebcd84ee
-
SHA256
9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e
-
SHA512
1d892e371932f17d939d67aae6185a505d430e3493c1071af8d64784b9dcf28139e299f4f9f0c02bbee477109c4e7a7df5790a5759b1d2d2da2adf33725af707
-
SSDEEP
3072:MhjM+HG0S3gHdCf6RKHMpf8vNQ8Y/iPmH3jmKGlhn6nd6pPpj:wIWvHwf6RjCv6XjTMN6d6
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\pshnybwu\\xvyajbgl.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
pewuodfrwjcgbbgu.exepid process 1480 pewuodfrwjcgbbgu.exe -
Processes:
resource yara_rule \Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exe upx \Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exe upx \Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exe upx \Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exe upx C:\Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exe upx -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xvyajbgl.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\xvyajbgl.exe svchost.exe -
Loads dropped DLL 4 IoCs
Processes:
9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exepid process 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\XvyAjbgl = "C:\\Users\\Admin\\AppData\\Local\\pshnybwu\\xvyajbgl.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: EnumeratesProcesses 42 IoCs
Processes:
svchost.exepid process 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe 2040 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 460 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exesvchost.exesvchost.exepewuodfrwjcgbbgu.exedescription pid process Token: SeSecurityPrivilege 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe Token: SeDebugPrivilege 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe Token: SeSecurityPrivilege 1972 svchost.exe Token: SeSecurityPrivilege 2040 svchost.exe Token: SeDebugPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeSecurityPrivilege 1480 pewuodfrwjcgbbgu.exe Token: SeLoadDriverPrivilege 1480 pewuodfrwjcgbbgu.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe Token: SeBackupPrivilege 2040 svchost.exe Token: SeRestorePrivilege 2040 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exedescription pid process target process PID 304 wrote to memory of 1972 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 1972 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 1972 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 1972 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 1972 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 1972 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 1972 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 1972 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 1972 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 1972 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 2040 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 2040 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 2040 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 2040 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 2040 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 2040 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 2040 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 2040 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 2040 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 2040 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe svchost.exe PID 304 wrote to memory of 1480 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe pewuodfrwjcgbbgu.exe PID 304 wrote to memory of 1480 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe pewuodfrwjcgbbgu.exe PID 304 wrote to memory of 1480 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe pewuodfrwjcgbbgu.exe PID 304 wrote to memory of 1480 304 9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe pewuodfrwjcgbbgu.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe"C:\Users\Admin\AppData\Local\Temp\9834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exe"C:\Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exeFilesize
138KB
MD5fa060f23e51febba321e0d1fc9bfa8cd
SHA1d0fa04ae2778037bc6ef107eaac86ed7ebcd84ee
SHA2569834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e
SHA5121d892e371932f17d939d67aae6185a505d430e3493c1071af8d64784b9dcf28139e299f4f9f0c02bbee477109c4e7a7df5790a5759b1d2d2da2adf33725af707
-
\Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exeFilesize
138KB
MD5fa060f23e51febba321e0d1fc9bfa8cd
SHA1d0fa04ae2778037bc6ef107eaac86ed7ebcd84ee
SHA2569834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e
SHA5121d892e371932f17d939d67aae6185a505d430e3493c1071af8d64784b9dcf28139e299f4f9f0c02bbee477109c4e7a7df5790a5759b1d2d2da2adf33725af707
-
\Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exeFilesize
138KB
MD5fa060f23e51febba321e0d1fc9bfa8cd
SHA1d0fa04ae2778037bc6ef107eaac86ed7ebcd84ee
SHA2569834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e
SHA5121d892e371932f17d939d67aae6185a505d430e3493c1071af8d64784b9dcf28139e299f4f9f0c02bbee477109c4e7a7df5790a5759b1d2d2da2adf33725af707
-
\Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exeFilesize
138KB
MD5fa060f23e51febba321e0d1fc9bfa8cd
SHA1d0fa04ae2778037bc6ef107eaac86ed7ebcd84ee
SHA2569834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e
SHA5121d892e371932f17d939d67aae6185a505d430e3493c1071af8d64784b9dcf28139e299f4f9f0c02bbee477109c4e7a7df5790a5759b1d2d2da2adf33725af707
-
\Users\Admin\AppData\Local\Temp\pewuodfrwjcgbbgu.exeFilesize
138KB
MD5fa060f23e51febba321e0d1fc9bfa8cd
SHA1d0fa04ae2778037bc6ef107eaac86ed7ebcd84ee
SHA2569834566e806fdd9f2afceb9897378bc38213b18fbc88e3ce125c7c9cdc28909e
SHA5121d892e371932f17d939d67aae6185a505d430e3493c1071af8d64784b9dcf28139e299f4f9f0c02bbee477109c4e7a7df5790a5759b1d2d2da2adf33725af707
-
memory/304-55-0x0000000074C91000-0x0000000074C93000-memory.dmpFilesize
8KB
-
memory/304-80-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/304-54-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1480-78-0x0000000000000000-mapping.dmp
-
memory/1480-83-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1480-84-0x0000000000400000-0x0000000000443000-memory.dmpFilesize
268KB
-
memory/1972-60-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/1972-59-0x0000000000000000-mapping.dmp
-
memory/1972-57-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2040-70-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2040-68-0x0000000000000000-mapping.dmp
-
memory/2040-66-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB