Analysis
- max time kernel
142s - max time network
108s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
30/01/2023, 02:15
Static task
static1
Behavioral task
behavioral1
Sample
ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe
Resource
win7-20220812-en
windows7-x64
20 signatures
150 seconds
General
- Target ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe
- Size 271KB
- Sample230130-cpn34afa21
- SHA256 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b
- MD5 228e350efceb0d09912a20f704187c7f
- SHA1 c5d36aeacc2bbfe345b18aaf40f5366bece1516f
- SHA512 fc765cb2b93ebd1237454e5123bb0a666818e82536b7981044436df24ba1c2c33f3c05de56fdebc2e37b86ff1d12d6d23d0fa8f743283cefe665317d50f88dba
- SSDEEP 6144:AmDj6owTqIe9OgF1b5YlZ9zMnEj5+0XjxZRfCG4m23Zeu+RzZDxE/:Adzq5AfzMnEd+Gj75j4m49+R
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe - Disables taskbar notifications via registry modification
- Executes dropped EXE 1 IoCs
pid Process 1968 B00E.tmp - Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
resource yara_rule behavioral1/memory/1476-55-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/1476-60-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/1600-62-0x0000000000400000-0x0000000000469000-memory.dmp upx behavioral1/memory/1496-74-0x0000000000400000-0x0000000000469000-memory.dmp upx - Loads dropped DLL 2 IoCs
pid Process 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe - Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
- Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\CC6.exe = "C:\\Program Files (x86)\\LP\\9B48\\CC6.exe" ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe - Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
- Drops file in Program Files directory 3 IoCs
description ioc Process File created C:\Program Files (x86)\LP\9B48\CC6.exe ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe File opened for modification C:\Program Files (x86)\LP\9B48\B00E.tmp ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe File opened for modification C:\Program Files (x86)\LP\9B48\CC6.exe ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe - Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe - Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2016 explorer.exe - Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeRestorePrivilege 1020 msiexec.exe Token: SeTakeOwnershipPrivilege 1020 msiexec.exe Token: SeSecurityPrivilege 1020 msiexec.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe Token: 33 1948 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1948 AUDIODG.EXE Token: 33 1948 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1948 AUDIODG.EXE Token: SeShutdownPrivilege 2016 explorer.exe Token: SeShutdownPrivilege 2016 explorer.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe - Suspicious use of SendNotifyMessage 17 IoCs
pid Process 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe 2016 explorer.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 1476 wrote to memory of 1600 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 29 PID 1476 wrote to memory of 1600 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 29 PID 1476 wrote to memory of 1600 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 29 PID 1476 wrote to memory of 1600 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 29 PID 1476 wrote to memory of 1968 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 34 PID 1476 wrote to memory of 1968 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 34 PID 1476 wrote to memory of 1968 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 34 PID 1476 wrote to memory of 1968 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 34 PID 1476 wrote to memory of 1496 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 35 PID 1476 wrote to memory of 1496 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 35 PID 1476 wrote to memory of 1496 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 35 PID 1476 wrote to memory of 1496 1476 ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe 35 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe"C:\Users\Admin\AppData\Local\Temp\ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exeC:\Users\Admin\AppData\Local\Temp\ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe startC:\Users\Admin\AppData\Roaming\800B5\20A9B.exe%C:\Users\Admin\AppData\Roaming\800B52⤵PID:1600
-
-
C:\Program Files (x86)\LP\9B48\B00E.tmp"C:\Program Files (x86)\LP\9B48\B00E.tmp"2⤵
- Executes dropped EXE
PID:1968
-
-
C:\Users\Admin\AppData\Local\Temp\ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exeC:\Users\Admin\AppData\Local\Temp\ad2be8668afc97250745f0219c942a00682f012508443eb6798755177bab167b.exe startC:\Program Files (x86)\B53BE\lvvm.exe%C:\Program Files (x86)\B53BE2⤵PID:1496
-
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1020
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2016
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5941⤵
- Suspicious use of AdjustPrivilegeToken
PID:1948
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Program Files (x86)\LP\9B48\B00E.tmp
- Size 97KB
- SHA256 7bf703e14628e66a3b853b18a860c275a7900eb111f00b55a8ca3beba1cde5a3
- MD5 68fe051f1a7bb8757d1db4a1f8965b10
- SHA1 07c07e5838a50091ef906998742cfcc271db19bb
- SHA512 33776ac48a4ab717088e69f6653e3ad95623be88364a3ce6cea2da53d0509e7153bcdd39e04d9ab28c42521d4c83e6212c1ff783d88e88e0a60783b77a5e7da1
- SSDEEP 3072:mkrKKeoUQKtk/UeyC8RzfCfVC0DI0mgCuTdT:mzMUUl8Rr6xoK
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\LP\9B48\B00E.tmp
- Size 97KB
- SHA256 7bf703e14628e66a3b853b18a860c275a7900eb111f00b55a8ca3beba1cde5a3
- MD5 68fe051f1a7bb8757d1db4a1f8965b10
- SHA1 07c07e5838a50091ef906998742cfcc271db19bb
- SHA512 33776ac48a4ab717088e69f6653e3ad95623be88364a3ce6cea2da53d0509e7153bcdd39e04d9ab28c42521d4c83e6212c1ff783d88e88e0a60783b77a5e7da1
- SSDEEP 3072:mkrKKeoUQKtk/UeyC8RzfCfVC0DI0mgCuTdT:mzMUUl8Rr6xoK
- MD5 SHA1 SHA512 SSDEEP
- Path \Program Files (x86)\LP\9B48\B00E.tmp
- Size 97KB
- SHA256 7bf703e14628e66a3b853b18a860c275a7900eb111f00b55a8ca3beba1cde5a3
- MD5 68fe051f1a7bb8757d1db4a1f8965b10
- SHA1 07c07e5838a50091ef906998742cfcc271db19bb
- SHA512 33776ac48a4ab717088e69f6653e3ad95623be88364a3ce6cea2da53d0509e7153bcdd39e04d9ab28c42521d4c83e6212c1ff783d88e88e0a60783b77a5e7da1
- SSDEEP 3072:mkrKKeoUQKtk/UeyC8RzfCfVC0DI0mgCuTdT:mzMUUl8Rr6xoK
- MD5 SHA1 SHA512 SSDEEP