a6f10947d6c37b62a4c0f5e4d0d32cc826a957c7d1026f316d5651262c4f0b24

Analysis

max time kernel
127s
max time network
131s
platform
windows7_x64
resource
win7-20230712-en
resource tags

arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system
submitted
13/07/2023, 23:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

Original/999bc5e16312db6abff5f6c9e54c546f.exe
Size

573KB
MD5

999bc5e16312db6abff5f6c9e54c546f
SHA1

c19761497efcdf156f50c014e7520fdae40822e7
SHA256

dc276b0113694ecc62913311e2580857754aa890173dfaa9d95afad6396bb741
SHA512

37d8403df63db243ec631267abb167da67acc257a45c775a8e646467e9c121820ce420bc15b920afdd386f2c5edcabe8d310ecd3074405c31ee37f348ec4c78d
SSDEEP

12288:wZ2BkVm1YvrIm9/nefmiM+Si2BiYRdAugT:GVm2rvJgmX+n2oYRdvA

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2652	yqmlbkMGVilldGk.exe

Executes dropped EXE 1 IoCs

pid	Process
2652	yqmlbkMGVilldGk.exe

Looks up external IP address via web service 1 IoCs

Uses a legitimate IP lookup service to find the infected system's external IP.

flow	ioc
16	icanhazip.com

Drops file in System32 directory 3 IoCs

description	ioc	Process
File created	C:\Windows\system32\config\systemprofile\AppData\Local\ne9bzef6m8.dll	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\ne9bzef6m8.dll	Process not Found
File opened for modification	C:\Windows\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Process not Found

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\yqmlbkMGVilldGk.exe	999bc5e16312db6abff5f6c9e54c546f.exe

Modifies data under HKEY_USERS 24 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Process not Found
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0072000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Process not Found
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7887083C-A0A3-4188-8789-09E99C404435}\WpadDecisionTime = 40a194a5dfb5d901	Process not Found
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7887083C-A0A3-4188-8789-09E99C404435}\WpadDecisionReason = "1"	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7887083C-A0A3-4188-8789-09E99C404435}\WpadNetworkName = "Network 2"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-fe-1c-92-a6-06	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7887083C-A0A3-4188-8789-09E99C404435}	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7887083C-A0A3-4188-8789-09E99C404435}\WpadDecision = "0"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-fe-1c-92-a6-06\WpadDecisionReason = "1"	Process not Found
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-fe-1c-92-a6-06\WpadDecisionTime = 40a194a5dfb5d901	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{7887083C-A0A3-4188-8789-09E99C404435}\ba-fe-1c-92-a6-06	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Process not Found
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Process not Found
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Process not Found
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Process not Found
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ba-fe-1c-92-a6-06\WpadDecision = "0"	Process not Found

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
2448	999bc5e16312db6abff5f6c9e54c546f.exe
2652	yqmlbkMGVilldGk.exe
2652	yqmlbkMGVilldGk.exe
2652	yqmlbkMGVilldGk.exe

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
2652	yqmlbkMGVilldGk.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2448	999bc5e16312db6abff5f6c9e54c546f.exe
Token: SeDebugPrivilege	2652	yqmlbkMGVilldGk.exe
Token: SeDebugPrivilege	592	Process not Found

Suspicious use of UnmapMainImage 2 IoCs

pid	Process
2448	999bc5e16312db6abff5f6c9e54c546f.exe
2652	yqmlbkMGVilldGk.exe

Suspicious use of WriteProcessMemory 7 IoCs

description	pid	Process	procid_target
PID 2448 wrote to memory of 2652	2448	999bc5e16312db6abff5f6c9e54c546f.exe	28
PID 2448 wrote to memory of 2652	2448	999bc5e16312db6abff5f6c9e54c546f.exe	28
PID 2448 wrote to memory of 2652	2448	999bc5e16312db6abff5f6c9e54c546f.exe	28
PID 2448 wrote to memory of 2652	2448	999bc5e16312db6abff5f6c9e54c546f.exe	28
PID 592 wrote to memory of 2108	592	Process not Found	30
PID 592 wrote to memory of 2108	592	Process not Found	30
PID 592 wrote to memory of 2108	592	Process not Found	30

C:\Users\Admin\AppData\Local\Temp\Original\999bc5e16312db6abff5f6c9e54c546f.exe
"C:\Users\Admin\AppData\Local\Temp\Original\999bc5e16312db6abff5f6c9e54c546f.exe"
1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:2448
- C:\Windows\yqmlbkMGVilldGk.exe
  C:\Users\Admin\AppData\Local\Temp\Original\999bc5e16312db6abff5f6c9e54c546f.exe
  2⤵
  - Deletes itself
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of UnmapMainImage
  PID:2652

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2108

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\yqmlbkMGVilldGk.exe

Filesize
573KB

MD5
999bc5e16312db6abff5f6c9e54c546f

SHA1
c19761497efcdf156f50c014e7520fdae40822e7

SHA256
dc276b0113694ecc62913311e2580857754aa890173dfaa9d95afad6396bb741

SHA512
37d8403df63db243ec631267abb167da67acc257a45c775a8e646467e9c121820ce420bc15b920afdd386f2c5edcabe8d310ecd3074405c31ee37f348ec4c78d

Download Submit
memory/592-70-0x0000000000530000-0x000000000056C000-memory.dmp

Filesize
240KB

Download
memory/592-79-0x0000000000570000-0x00000000005B1000-memory.dmp

Filesize
260KB

Download
memory/592-71-0x0000000000570000-0x00000000005B1000-memory.dmp

Filesize
260KB

Download
memory/592-73-0x0000000000570000-0x00000000005B1000-memory.dmp

Filesize
260KB

Download
memory/592-75-0x0000000000570000-0x00000000005B1000-memory.dmp

Filesize
260KB

Download
memory/592-76-0x0000000000570000-0x00000000005B1000-memory.dmp

Filesize
260KB

Download
memory/592-80-0x0000000000570000-0x00000000005B1000-memory.dmp

Filesize
260KB

Download
memory/2448-54-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2448-63-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2448-56-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2448-55-0x0000000000310000-0x0000000000311000-memory.dmp

Filesize
4KB

Download
memory/2652-65-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download
memory/2652-78-0x0000000000400000-0x0000000000464000-memory.dmp

Filesize
400KB

Download
memory/2652-77-0x0000000000400000-0x0000000000493000-memory.dmp

Filesize
588KB

Download