Analysis
-
max time kernel
154s -
max time network
158s -
platform
windows10-2004_x64 -
resource
win10v2004-20230220-en -
resource tags
arch:x64arch:x86image:win10v2004-20230220-enlocale:en-usos:windows10-2004-x64system -
submitted
06-05-2023 21:01
Static task
static1
Behavioral task
behavioral1
Sample
Setup for uplink_patch1_reJ7-Z1.exe
Resource
win7-20230220-en
Behavioral task
behavioral2
Sample
Setup for uplink_patch1_reJ7-Z1.exe
Resource
win10v2004-20230220-en
General
-
Target
Setup for uplink_patch1_reJ7-Z1.exe
-
Size
1.7MB
-
MD5
99a9fbd5fee72ce51585309390a46717
-
SHA1
ff39c56312090a909c2c0c82629c552a3b252a98
-
SHA256
833064195b0c96bce9a8c00dc95df6bd9fce1092c1260ba0e877810bfc44b0aa
-
SHA512
97f9a98fb48c8281818163d3dbe66fa246e1fe6a5a67f15175419992b0ca389cbe086e457177c21ce9c99ff05a1e0b508812cdf30220090a438dd8c94f73c6b7
-
SSDEEP
24576:R4nXubIQGyxbPV0db26Wmd0l4sv1Et9uGpckT52zedlq89Ws5uIzk5aM/phdO7:Rqe3f61mZSffPMWrQ0ZkA
Malware Config
Signatures
-
Downloads MZ/PE file
-
Executes dropped EXE 3 IoCs
Processes:
Setup for uplink_patch1_reJ7-Z1.tmpfile_reJ7-Z1.exefile_reJ7-Z1.tmppid process 3064 Setup for uplink_patch1_reJ7-Z1.tmp 1680 file_reJ7-Z1.exe 4832 file_reJ7-Z1.tmp -
Loads dropped DLL 3 IoCs
Processes:
file_reJ7-Z1.tmppid process 4832 file_reJ7-Z1.tmp 4832 file_reJ7-Z1.tmp 4832 file_reJ7-Z1.tmp -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
Processes:
taskmgr.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_DADY&Prod_HARDDISK\4&215468a5&0&000000 taskmgr.exe -
Script User-Agent 1 IoCs
Uses user-agent string associated with script host/environment.
Processes:
description flow ioc HTTP User-Agent header 27 Mozilla/4.0 (compatible; Win32; WinHttp.WinHttpRequest.5) -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
taskmgr.exepid process 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
taskmgr.exepid process 5008 taskmgr.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
taskmgr.exedescription pid process Token: SeDebugPrivilege 5008 taskmgr.exe Token: SeSystemProfilePrivilege 5008 taskmgr.exe Token: SeCreateGlobalPrivilege 5008 taskmgr.exe -
Suspicious use of FindShellTrayWindow 64 IoCs
Processes:
Setup for uplink_patch1_reJ7-Z1.tmptaskmgr.exepid process 3064 Setup for uplink_patch1_reJ7-Z1.tmp 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe -
Suspicious use of SendNotifyMessage 64 IoCs
Processes:
taskmgr.exepid process 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe 5008 taskmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
Setup for uplink_patch1_reJ7-Z1.exeSetup for uplink_patch1_reJ7-Z1.tmpfile_reJ7-Z1.exedescription pid process target process PID 3644 wrote to memory of 3064 3644 Setup for uplink_patch1_reJ7-Z1.exe Setup for uplink_patch1_reJ7-Z1.tmp PID 3644 wrote to memory of 3064 3644 Setup for uplink_patch1_reJ7-Z1.exe Setup for uplink_patch1_reJ7-Z1.tmp PID 3644 wrote to memory of 3064 3644 Setup for uplink_patch1_reJ7-Z1.exe Setup for uplink_patch1_reJ7-Z1.tmp PID 3064 wrote to memory of 1680 3064 Setup for uplink_patch1_reJ7-Z1.tmp file_reJ7-Z1.exe PID 3064 wrote to memory of 1680 3064 Setup for uplink_patch1_reJ7-Z1.tmp file_reJ7-Z1.exe PID 3064 wrote to memory of 1680 3064 Setup for uplink_patch1_reJ7-Z1.tmp file_reJ7-Z1.exe PID 1680 wrote to memory of 4832 1680 file_reJ7-Z1.exe file_reJ7-Z1.tmp PID 1680 wrote to memory of 4832 1680 file_reJ7-Z1.exe file_reJ7-Z1.tmp PID 1680 wrote to memory of 4832 1680 file_reJ7-Z1.exe file_reJ7-Z1.tmp
Processes
-
C:\Users\Admin\AppData\Local\Temp\Setup for uplink_patch1_reJ7-Z1.exe"C:\Users\Admin\AppData\Local\Temp\Setup for uplink_patch1_reJ7-Z1.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-OJLSO.tmp\Setup for uplink_patch1_reJ7-Z1.tmp"C:\Users\Admin\AppData\Local\Temp\is-OJLSO.tmp\Setup for uplink_patch1_reJ7-Z1.tmp" /SL5="$E006A,831488,831488,C:\Users\Admin\AppData\Local\Temp\Setup for uplink_patch1_reJ7-Z1.exe"2⤵
- Executes dropped EXE
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-SNLRF.tmp\file_reJ7-Z1.exe"C:\Users\Admin\AppData\Local\Temp\is-SNLRF.tmp\file_reJ7-Z1.exe" /LANG=en /NA=Rh85hR643⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\is-F16N6.tmp\file_reJ7-Z1.tmp"C:\Users\Admin\AppData\Local\Temp\is-F16N6.tmp\file_reJ7-Z1.tmp" /SL5="$201FA,1559708,780800,C:\Users\Admin\AppData\Local\Temp\is-SNLRF.tmp\file_reJ7-Z1.exe" /LANG=en /NA=Rh85hR644⤵
- Executes dropped EXE
- Loads dropped DLL
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /71⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\is-43RFU.tmp\Helper.dllFilesize
2.0MB
MD54eb0347e66fa465f602e52c03e5c0b4b
SHA1fdfedb72614d10766565b7f12ab87f1fdca3ea81
SHA256c73e53cbb7b98feafe27cc7de8fdad51df438e2235e91891461c5123888f73cc
SHA5124c909a451059628119f92b2f0c8bcd67b31f63b57d5339b6ce8fd930be5c9baf261339fdd9da820321be497df8889ce7594b7bfaadbaa43c694156651bf6c1fd
-
C:\Users\Admin\AppData\Local\Temp\is-43RFU.tmp\botva2.dllFilesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
C:\Users\Admin\AppData\Local\Temp\is-43RFU.tmp\botva2.dllFilesize
37KB
MD567965a5957a61867d661f05ae1f4773e
SHA1f14c0a4f154dc685bb7c65b2d804a02a0fb2360d
SHA256450b9b0ba25bf068afbc2b23d252585a19e282939bf38326384ea9112dfd0105
SHA512c6942818b9026dc5db2d62999d32cf99fe7289f79a28b8345af17acf9d13b2229a5e917a48ff1f6d59715bdbcb00c1625e0302abcfe10ca7e0475762e0a3f41b
-
C:\Users\Admin\AppData\Local\Temp\is-F16N6.tmp\file_reJ7-Z1.tmpFilesize
2.9MB
MD5623a3abd7b318e1f410b1e12a42c7b71
SHA188e34041850ec4019dae469adc608e867b936d21
SHA256fe1a4555d18617532248d2eaa8d3fcc2c74182f994a964a62cf418295e8554d3
SHA5129afea88e4617e0f11416c2a2c416a6aa2d5d1f702d98d2cc223b399736191a6d002d1b717020ca6aae09e835c6356b7ddafad71e101dacab15967d89a105e391
-
C:\Users\Admin\AppData\Local\Temp\is-OJLSO.tmp\Setup for uplink_patch1_reJ7-Z1.tmpFilesize
3.0MB
MD50c229cd26910820581b5809c62fe5619
SHA128c0630385b21f29e3e2bcc34865e5d15726eaa0
SHA256abfa49a915d2e0a82561ca440365e6a2d59f228533b56a8f78addf000a1081b3
SHA512b8ff3dc65f7c0e03721572af738ec4886ba895dc70c1a41a3ce8c8abe0946d167cec71913017fd11d5892452db761ea88901a5a09a681ae779dd531edbb83a2a
-
C:\Users\Admin\AppData\Local\Temp\is-SNLRF.tmp\file_reJ7-Z1.exeFilesize
2.3MB
MD5e33cc3f7373fa131b295ed8551ca3343
SHA1734dd1751cc4e51288b4b34159cbffe0e74c1310
SHA256dddd2d7596ce3e6f21a5344a607c9e0a0fb472d5b6df2bd2b87c9cfc6b275d0a
SHA51279e8bb7cfa9bff1657e3e0046f1da3224b935ce3695c437ecb098708e4a3ec97b5f24ccdd30078d5945ad922c04d6c48f20290133a2d411ca5b34116b63e5ea3
-
C:\Users\Admin\AppData\Local\Temp\is-SNLRF.tmp\file_reJ7-Z1.exeFilesize
2.3MB
MD5e33cc3f7373fa131b295ed8551ca3343
SHA1734dd1751cc4e51288b4b34159cbffe0e74c1310
SHA256dddd2d7596ce3e6f21a5344a607c9e0a0fb472d5b6df2bd2b87c9cfc6b275d0a
SHA51279e8bb7cfa9bff1657e3e0046f1da3224b935ce3695c437ecb098708e4a3ec97b5f24ccdd30078d5945ad922c04d6c48f20290133a2d411ca5b34116b63e5ea3
-
memory/1680-146-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/1680-176-0x0000000000400000-0x00000000004CC000-memory.dmpFilesize
816KB
-
memory/3064-138-0x0000000002800000-0x0000000002801000-memory.dmpFilesize
4KB
-
memory/3064-150-0x0000000002800000-0x0000000002801000-memory.dmpFilesize
4KB
-
memory/3064-141-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/3064-163-0x0000000000400000-0x000000000071A000-memory.dmpFilesize
3.1MB
-
memory/3644-165-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3644-139-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/3644-133-0x0000000000400000-0x00000000004D8000-memory.dmpFilesize
864KB
-
memory/4832-174-0x0000000000400000-0x00000000006EE000-memory.dmpFilesize
2.9MB
-
memory/4832-169-0x0000000006280000-0x000000000628F000-memory.dmpFilesize
60KB
-
memory/4832-161-0x00000000008A0000-0x00000000008A1000-memory.dmpFilesize
4KB
-
memory/5008-177-0x00000240E64D0000-0x00000240E64D1000-memory.dmpFilesize
4KB
-
memory/5008-179-0x00000240E64D0000-0x00000240E64D1000-memory.dmpFilesize
4KB
-
memory/5008-178-0x00000240E64D0000-0x00000240E64D1000-memory.dmpFilesize
4KB
-
memory/5008-183-0x00000240E64D0000-0x00000240E64D1000-memory.dmpFilesize
4KB
-
memory/5008-189-0x00000240E64D0000-0x00000240E64D1000-memory.dmpFilesize
4KB
-
memory/5008-188-0x00000240E64D0000-0x00000240E64D1000-memory.dmpFilesize
4KB
-
memory/5008-187-0x00000240E64D0000-0x00000240E64D1000-memory.dmpFilesize
4KB
-
memory/5008-185-0x00000240E64D0000-0x00000240E64D1000-memory.dmpFilesize
4KB
-
memory/5008-184-0x00000240E64D0000-0x00000240E64D1000-memory.dmpFilesize
4KB
-
memory/5008-186-0x00000240E64D0000-0x00000240E64D1000-memory.dmpFilesize
4KB