Analysis

  • max time kernel
    149s
  • max time network
    33s
  • platform
    windows7_x64
  • resource
    win7-20230621-en
  • resource tags

    arch:x64arch:x86image:win7-20230621-enlocale:en-usos:windows7-x64system
  • submitted
    30/06/2023, 12:37

General

  • Target

    zxcvb.exe

  • Size

    2.0MB

  • MD5

    69773ff9cddbe895d0c1a7c381e15d81

  • SHA1

    15a2796b6b77bd1f03eb0a30cfeb7e3c2f0a0631

  • SHA256

    fc6ddb1f7644597b84d14e3efa4cd1a1d1ad0083141b3fa2a613cd3c092f6505

  • SHA512

    550f9e02a7f1a1dc3734ba0d86940c2b298cee5890801aeba4f738bb306cdc717a6ecad34e2ebd2c3ac1b0151f2acae7131388f999a30ab9b914c3707a35544e

  • SSDEEP

    49152:NZVlrVqLTyYBYTKiJHZ+guvLN09WIfw8eZrjwMmPK:7hIGKiJk7LN09WKOdMMmy

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 6 IoCs
  • Loads dropped DLL 4 IoCs
  • Drops file in System32 directory 1 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 8 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
    "C:\Users\Admin\AppData\Local\Temp\zxcvb.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1668
    • C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe
      "C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of SetThreadContext
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:2000
      • C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe
        C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe
        3⤵
        • Executes dropped EXE
        PID:1672
      • C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe
        C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe
        3⤵
        • Executes dropped EXE
        PID:1692
      • C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe
        C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of AdjustPrivilegeToken
        PID:1264
    • C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
      C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
      2⤵
        PID:840
      • C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
        C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
        2⤵
          PID:1980
        • C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
          C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
          2⤵
            PID:112
          • C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
            C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
            2⤵
              PID:564
            • C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
              C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
              2⤵
                PID:1552
              • C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
                C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
                2⤵
                  PID:916
                • C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
                  C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
                  2⤵
                    PID:1540
                  • C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
                    C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
                    2⤵
                      PID:836
                    • C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
                      C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
                      2⤵
                        PID:1544
                      • C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
                        C:\Users\Admin\AppData\Local\Temp\zxcvb.exe
                        2⤵
                          PID:1532
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {AE878AD3-3EAA-459F-895B-2BE58E5EBB4D} S-1-5-21-3518257231-2980324860-1431329550-1000:VWMLZJGN\Admin:S4U:
                        1⤵
                        • Suspicious use of WriteProcessMemory
                        PID:240
                        • C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
                          powershell.exe -ExecutionPolicy Bypass -WindowStyle Hidden -NoProfile -enc UwBlAHQALQBNAHAAUAByAGUAZgBlAHIAZQBuAGMAZQAgAC0ARQB4AGMAbAB1AHMAaQBvAG4AUABhAHQAaAAgAEMAOgBcAA==
                          2⤵
                          • Drops file in System32 directory
                          • Suspicious behavior: EnumeratesProcesses
                          • Suspicious use of AdjustPrivilegeToken
                          PID:1988
                      • C:\Windows\system32\taskeng.exe
                        taskeng.exe {C7793013-48AD-4E24-9C83-C9304AF67865} S-1-5-21-3518257231-2980324860-1431329550-1000:VWMLZJGN\Admin:Interactive:[1]
                        1⤵
                          PID:808
                          • C:\Users\Admin\AppData\Local\EventProvider\anpil\CanReuseTransform.exe
                            C:\Users\Admin\AppData\Local\EventProvider\anpil\CanReuseTransform.exe
                            2⤵
                            • Executes dropped EXE
                            • Suspicious use of SetThreadContext
                            • Suspicious use of AdjustPrivilegeToken
                            PID:2000
                            • C:\Users\Admin\AppData\Local\EventProvider\anpil\CanReuseTransform.exe
                              C:\Users\Admin\AppData\Local\EventProvider\anpil\CanReuseTransform.exe
                              3⤵
                              • Executes dropped EXE
                              • Suspicious use of SetThreadContext
                              • Suspicious behavior: EnumeratesProcesses
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1548
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                4⤵
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1988
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                  C:\Windows\Microsoft.NET\Framework\v4.0.30319\MSBuild.exe
                                  5⤵
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:1744

                        Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              • C:\Users\Admin\AppData\Local\EventProvider\anpil\CanReuseTransform.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • C:\Users\Admin\AppData\Local\EventProvider\anpil\CanReuseTransform.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • C:\Users\Admin\AppData\Local\EventProvider\anpil\CanReuseTransform.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • C:\Users\Admin\AppData\Local\EventProvider\anpil\CanReuseTransform.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • C:\Users\Admin\AppData\Local\Temp\BLIrlccnw.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • \Users\Admin\AppData\Local\Temp\BLIrlccnw.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • \Users\Admin\AppData\Local\Temp\BLIrlccnw.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • \Users\Admin\AppData\Local\Temp\BLIrlccnw.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • \Users\Admin\AppData\Local\Temp\BLIrlccnw.exe

                                Filesize

                                1.2MB

                                MD5

                                fc6f64c6b52d80c505cc7d6f04d0952e

                                SHA1

                                1c472c2ceb83bfcd5adc6770e35594a5b0ec5390

                                SHA256

                                c2061f2b7856cda556570a83ba325c684a2a72fed77eb322ae661714a77c9040

                                SHA512

                                cc0a6d32eeafd0238510cf327d8f71cc94f4ee5997389071c7431ee06446f88ecfe9fe8f7c5adbe88ea3c889d066dd7a862bd4eda2301dc129f8f4c4174f9e9c

                              • memory/1264-1934-0x00000000045F0000-0x00000000046D6000-memory.dmp

                                Filesize

                                920KB

                              • memory/1264-1933-0x0000000000400000-0x000000000049A000-memory.dmp

                                Filesize

                                616KB

                              • memory/1264-2000-0x0000000004A30000-0x0000000004A70000-memory.dmp

                                Filesize

                                256KB

                              • memory/1264-4114-0x0000000000980000-0x00000000009D6000-memory.dmp

                                Filesize

                                344KB

                              • memory/1264-4115-0x0000000004A30000-0x0000000004A70000-memory.dmp

                                Filesize

                                256KB

                              • memory/1264-4116-0x0000000004EB0000-0x0000000004F04000-memory.dmp

                                Filesize

                                336KB

                              • memory/1548-7244-0x00000000044D0000-0x0000000004510000-memory.dmp

                                Filesize

                                256KB

                              • memory/1548-5064-0x0000000000400000-0x000000000049A000-memory.dmp

                                Filesize

                                616KB

                              • memory/1548-5204-0x00000000044D0000-0x0000000004510000-memory.dmp

                                Filesize

                                256KB

                              • memory/1668-88-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-86-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-112-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-110-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-108-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-106-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-104-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-102-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-100-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-98-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-96-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-94-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-92-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-90-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-979-0x0000000000610000-0x0000000000611000-memory.dmp

                                Filesize

                                4KB

                              • memory/1668-981-0x0000000001FD0000-0x000000000201C000-memory.dmp

                                Filesize

                                304KB

                              • memory/1668-980-0x0000000004F40000-0x00000000050CA000-memory.dmp

                                Filesize

                                1.5MB

                              • memory/1668-982-0x0000000004550000-0x0000000004590000-memory.dmp

                                Filesize

                                256KB

                              • memory/1668-116-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-118-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-120-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-55-0x0000000004960000-0x0000000004B60000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-56-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-57-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-61-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-59-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-54-0x00000000003D0000-0x00000000005DA000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-114-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-84-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-82-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-76-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-78-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-80-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-69-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-70-0x0000000004550000-0x0000000004590000-memory.dmp

                                Filesize

                                256KB

                              • memory/1668-72-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-74-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-65-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-67-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1668-63-0x0000000004960000-0x0000000004B5A000-memory.dmp

                                Filesize

                                2.0MB

                              • memory/1744-8234-0x0000000002110000-0x0000000002150000-memory.dmp

                                Filesize

                                256KB

                              • memory/1988-7255-0x0000000000400000-0x0000000000540000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/1988-4124-0x00000000010E0000-0x0000000001160000-memory.dmp

                                Filesize

                                512KB

                              • memory/1988-4125-0x0000000000E80000-0x0000000000E88000-memory.dmp

                                Filesize

                                32KB

                              • memory/1988-4126-0x00000000010E0000-0x0000000001160000-memory.dmp

                                Filesize

                                512KB

                              • memory/1988-4122-0x0000000019B90000-0x0000000019E72000-memory.dmp

                                Filesize

                                2.9MB

                              • memory/1988-4123-0x00000000010E0000-0x0000000001160000-memory.dmp

                                Filesize

                                512KB

                              • memory/1988-7256-0x0000000004990000-0x00000000049D0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2000-4129-0x0000000000B80000-0x0000000000CC0000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2000-1003-0x0000000004AF0000-0x0000000004B30000-memory.dmp

                                Filesize

                                256KB

                              • memory/2000-991-0x0000000004910000-0x0000000004A44000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2000-990-0x00000000009E0000-0x0000000000B20000-memory.dmp

                                Filesize

                                1.2MB

                              • memory/2000-1915-0x0000000000430000-0x0000000000431000-memory.dmp

                                Filesize

                                4KB

                              • memory/2000-4194-0x0000000004C70000-0x0000000004CB0000-memory.dmp

                                Filesize

                                256KB

                              • memory/2000-1916-0x0000000004E10000-0x0000000004ED0000-memory.dmp

                                Filesize

                                768KB