Analysis
-
max time kernel
151s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
24/08/2023, 00:16
Behavioral task
behavioral1
Sample
ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe
Resource
win7-20230712-en
windows7-x64
General
-
Target
ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe
-
Size
274KB
-
MD5
9f8568844cdfa628bf47df040bc43326
-
SHA1
9136b4c3d52e17cfc9f77a4624fe59fe29a6e01f
-
SHA256
ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2
-
SHA512
0a2315e258431ab1d289e609b955a1736a45d591743a092a0efd087de39b851c1b6713b93cd7b3da2c8ad307a75a09f6a622552878b50937e9d5cf0d75db84dc
-
SSDEEP
6144:xbTirrfykiiUjh6QH/cEOkCybEaQRXr9HNdvOa:xPcrfR6ZnOkx2LIa
Malware Config
Signatures
-
Drops file in Drivers directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\fwfZCx4X0oIOUn.fbe Explorer.EXE File opened for modification C:\Windows\system32\drivers\rWDkyBCSgxaeN.sys Explorer.EXE File opened for modification C:\Windows\system32\drivers\yBFBWL5a1xOeBw.yab Explorer.EXE File opened for modification C:\Windows\system32\drivers\3IUFGlxCir.fov Explorer.EXE File opened for modification C:\Windows\system32\drivers\lLzogX5IVw.sys Explorer.EXE File created C:\Windows\System32\drivers\xACgpLY.sys Explorer.EXE File opened for modification C:\Windows\system32\drivers\QTDo8ShR3phmsM.sys Explorer.EXE File opened for modification C:\Windows\system32\drivers\l1RsE5BfNM.xgk Explorer.EXE File opened for modification C:\Windows\system32\drivers\wS2iKjgGehB.sys Explorer.EXE -
resource yara_rule behavioral2/memory/836-0-0x0000000000200000-0x000000000028C000-memory.dmp upx behavioral2/memory/836-19-0x0000000000200000-0x000000000028C000-memory.dmp upx behavioral2/memory/836-30-0x0000000000200000-0x000000000028C000-memory.dmp upx behavioral2/memory/836-56-0x0000000000200000-0x000000000028C000-memory.dmp upx -
Unexpected DNS network traffic destination 5 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 114.114.0.114 Destination IP 223.5.5.5 Destination IP 114.114.114.114 Destination IP 114.114.114.114 Destination IP 114.114.114.114 -
resource yara_rule behavioral2/files/0x00090000000231c8-82.dat vmprotect behavioral2/files/0x0006000000023204-110.dat vmprotect behavioral2/files/0x001c0000000231c8-138.dat vmprotect behavioral2/files/0x000a000000023202-166.dat vmprotect -
Drops file in System32 directory 9 IoCs
description ioc Process File opened for modification C:\Windows\system32\E7pP0sZUWB.sys Explorer.EXE File opened for modification C:\Windows\system32\54957DyeO7GV.fro Explorer.EXE File opened for modification C:\Windows\system32\7Nvom6s1Gbso.sys Explorer.EXE File opened for modification C:\Windows\system32\k52YTMgNLgMmeU.ytx Explorer.EXE File opened for modification C:\Windows\system32\0C9dYXgcvD.sys Explorer.EXE File opened for modification C:\Windows\system32\hVPNpYl6aZYF.zht Explorer.EXE File created C:\Windows\system32\ \Windows\System32\zb6SEax.sys Explorer.EXE File opened for modification C:\Windows\system32\MsMlLMLrOhTo.mcl Explorer.EXE File opened for modification C:\Windows\system32\I8iaJviz6pRmqa.sys Explorer.EXE -
Drops file in Program Files directory 21 IoCs
description ioc Process File opened for modification C:\Program Files\EaeQA9ogeoJ.sys Explorer.EXE File opened for modification C:\Program Files\96YncXaXgU6q.sys Explorer.EXE File opened for modification C:\Program Files (x86)\Jd4AtcLoZu.sys Explorer.EXE File opened for modification C:\Program Files\Windows Media Player\39618458.js Explorer.EXE File opened for modification C:\Program Files\Windows Media Player\56124684.js Explorer.EXE File opened for modification C:\Program Files\BengGaTl8v.tts Explorer.EXE File opened for modification C:\Program Files\C4TqZg3gSN.mgn Explorer.EXE File opened for modification C:\Program Files\Windows Media Player\manifest.json Explorer.EXE File opened for modification C:\Program Files\3SGx7maZQ1.zbu Explorer.EXE File opened for modification C:\Program Files (x86)\Ru8S8wbcIoGXPW.yia Explorer.EXE File opened for modification C:\Program Files (x86)\9ZjQSQF5PA6KK.sys Explorer.EXE File opened for modification C:\Program Files (x86)\pL6mcbfWN2pbY.ukg Explorer.EXE File opened for modification C:\Program Files (x86)\vPpzYGbq6R13.sys Explorer.EXE File opened for modification C:\Program Files (x86)\mXyrg4Dy54.glw Explorer.EXE File opened for modification C:\Program Files\Ka2eskPcnP.sys Explorer.EXE File opened for modification C:\Program Files (x86)\nZh7YK7xJb.sys Explorer.EXE File opened for modification C:\Program Files (x86)\9YmDB96rIuv.kem Explorer.EXE File opened for modification C:\Program Files\8y2SAFtQ8ORwSj.mhp Explorer.EXE File opened for modification C:\Program Files\Windows Media Player\47b9e56e.html Explorer.EXE File opened for modification C:\Program Files\Windows Media Player\lib\646aa79a.js Explorer.EXE File opened for modification C:\Program Files\rIsKCGHiUDMX8.sys Explorer.EXE -
Drops file in Windows directory 10 IoCs
description ioc Process File opened for modification C:\Windows\7RBH7tlNiwM.sys Explorer.EXE File opened for modification C:\Windows\err_836.log ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe File created C:\Windows\kW72Is3.sys Explorer.EXE File opened for modification C:\Windows\IGIavcuCI5C76.nec Explorer.EXE File opened for modification C:\Windows\fY7pa9aA70x.pfj Explorer.EXE File opened for modification C:\Windows\4yzIC0pjFldcLS.icg Explorer.EXE File opened for modification C:\Windows\vjMX9wAwPw.sys Explorer.EXE File opened for modification C:\Windows\6dEEp9sXGbp84.sys Explorer.EXE File opened for modification C:\Windows\Qmp0NIMb6fYYIb.xnt Explorer.EXE File opened for modification C:\Windows\hKPIUTuC8rsh.sys Explorer.EXE -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Delays execution with timeout.exe 1 IoCs
pid Process 3172 timeout.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE 3152 Explorer.EXE -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3152 Explorer.EXE -
Suspicious behavior: LoadsDriver 59 IoCs
pid Process 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found 676 Process not Found -
Suspicious use of AdjustPrivilegeToken 19 IoCs
description pid Process Token: SeDebugPrivilege 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe Token: SeTcbPrivilege 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe Token: SeDebugPrivilege 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe Token: SeDebugPrivilege 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe Token: SeDebugPrivilege 3152 Explorer.EXE Token: SeDebugPrivilege 3152 Explorer.EXE Token: SeDebugPrivilege 3152 Explorer.EXE Token: SeIncBasePriorityPrivilege 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe Token: SeShutdownPrivilege 3152 Explorer.EXE Token: SeCreatePagefilePrivilege 3152 Explorer.EXE Token: SeDebugPrivilege 3152 Explorer.EXE Token: SeBackupPrivilege 3152 Explorer.EXE Token: SeDebugPrivilege 3152 Explorer.EXE Token: SeDebugPrivilege 404 dwm.exe Token: SeBackupPrivilege 404 dwm.exe Token: SeShutdownPrivilege 404 dwm.exe Token: SeCreatePagefilePrivilege 404 dwm.exe Token: SeShutdownPrivilege 404 dwm.exe Token: SeCreatePagefilePrivilege 404 dwm.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3152 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 836 wrote to memory of 3152 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 53 PID 836 wrote to memory of 3152 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 53 PID 836 wrote to memory of 3152 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 53 PID 836 wrote to memory of 3152 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 53 PID 836 wrote to memory of 3152 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 53 PID 836 wrote to memory of 636 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 6 PID 836 wrote to memory of 636 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 6 PID 836 wrote to memory of 636 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 6 PID 836 wrote to memory of 636 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 6 PID 836 wrote to memory of 636 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 6 PID 836 wrote to memory of 1468 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 90 PID 836 wrote to memory of 1468 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 90 PID 836 wrote to memory of 1468 836 ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe 90 PID 1468 wrote to memory of 3172 1468 cmd.exe 92 PID 1468 wrote to memory of 3172 1468 cmd.exe 92 PID 1468 wrote to memory of 3172 1468 cmd.exe 92 PID 3152 wrote to memory of 404 3152 Explorer.EXE 9 PID 3152 wrote to memory of 404 3152 Explorer.EXE 9 PID 3152 wrote to memory of 404 3152 Explorer.EXE 9 PID 3152 wrote to memory of 404 3152 Explorer.EXE 9 PID 3152 wrote to memory of 404 3152 Explorer.EXE 9 PID 3152 wrote to memory of 404 3152 Explorer.EXE 9
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:636
-
C:\Windows\system32\dwm.exe"dwm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
PID:404
-
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Drops file in Drivers directory
- Drops file in System32 directory
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3152 -
C:\Users\Admin\AppData\Local\Temp\ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe"C:\Users\Admin\AppData\Local\Temp\ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe"2⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 1 & del /Q /F "C:\Users\Admin\AppData\Local\Temp\ad3f522829029ddeb896d7f6c92132ca6c0715bebd815a69c22cc48c1e187cc2.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1468 -
C:\Windows\SysWOW64\timeout.exetimeout /t 14⤵
- Delays execution with timeout.exe
PID:3172
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A
Filesize2KB
MD51215ba64edcd9b1a1626ff75b7d8f318
SHA182b1ed7ee8dde3a78399d6ffccbd1f85c3f2b9d7
SHA256da2352c2a4a3251c79f4e358419a5d5271887cd8b79212d16677f33e1378d65b
SHA512b7e3bc7621c1cd4c4959ce2682d2bcf91306c35116e6e0b91089d3d5c2f282555aac38f6c27d1e9a0d894b6e41a43ac51d3528d1ca0cc010af9f4a3414911727
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\Content\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize1KB
MD51f94d4d280ff409d554abab350d17ef1
SHA16df310f84e1b99164310b7324996b71a3cb3fe24
SHA256047a1f77bd04d3b566fe9f71e653e788ba99ecfa954cd169fde5b70517350a11
SHA51225e67e76e011e6cb6bfd4654daef6a7c30d67db62006519549b209b3e0f6714437e08ce5ff2f26a8da54e9f0b37482ceb1ad0c2e15ee7cdb4d79347d7e0309fd
-
Filesize
599B
MD51de27fb2aa3e4c249698c34280c118eb
SHA145534e7447599f44dff503d39a4d9cd3183a3bf0
SHA256dc1cc2098e15f279db4cd223647977a8bd0bbf5f83b60478f904c2ef336947a4
SHA512bd43aa1690c1f52ba47759695ff28303ac1de803f46bdadf09a950235b48ebd246f547afb3536311959d0b914192f4515a720597f270251b0f46c796e397bc14
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\07CEF2F654E3ED6050FFC9B6EB844250_DD02D25E799024F48A93E8EE3BDDA41A
Filesize484B
MD57a560f1ad069056c57650037c4cf7b7e
SHA1d8c76b0271f46e78299409777d9799333182d3a1
SHA2561fbf7a487f136ce9ebe0428b807e915c6b244b7bb8370c52cee4d8558054dff0
SHA512a5e87dfbdae9b7019aeae1a7681d0d33f729c1d6ab9d41948b70d4aeae5623118ae6a3857b32c52d270ab8035c259353fc693b1812aa3e6ab3072ae8094285f9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\B2FAF7692FD9FFBD64EDE317E42334BA_D7393C8F62BDE4D4CB606228BC7A711E
Filesize482B
MD5304a63da43d1fb82042bfb2346b1ad65
SHA10d83a530835626bdfd8d38799fd80ed5c42b4807
SHA2562a97dd7a72b2cbffd75f177bd5e3a75eac37c01c6fc213be9e5f8b73defe1b2b
SHA512b716a1cfd3cea0ec37b9861884e51b5609c75db67b96d59ba474a3e40633cdd7e3933f2bbe7a30c369279d262a45742a294362c0de97928561ceffe9e29ea9b9
-
C:\Users\Admin\AppData\LocalLow\Microsoft\CryptnetUrlCache\MetaData\DED9969D7ED2C6E555C5C9254A43EDE4
Filesize504B
MD5d43c541f718647a090a0f27e79b38ac4
SHA169ad3c070782d9bda6f01a073322d0ff7421fb5d
SHA25664a6248d0f7b06ba43dfa2d92f9e98f32ded377cd56144067b448171eb738324
SHA512bef4bc003ed84a5285b3e4a03bc0d5eb09fd1ff7058037500c3a5fff844bbd26559bc4d733b9d5d04c61c119e90971511c28e0b40db5eca413936118ba6230b0
-
Filesize
447KB
MD5ba3aa9fa868beeb69ecf7dec83a5322e
SHA113c9cec5b678966109bce6bff784dbbd912aa9b1
SHA256cfb46358f4dd1e39148f7a7f3c2121f89665bef791f0534809f5b36993befb05
SHA5128effa6748e908a75ef9cb47e9a55af29a9f2ab1988da701d68c4606ea58e82e58234cc1487c87e7137e2653edf08788ad63e0116300a896519eecc0501832699
-
Filesize
415KB
MD5b42c4b476a478d8d9c03351e9b56b498
SHA181069a4a6b2e8a7d5b959ed8c9933a7ae4551412
SHA256ee0172f88f7029171906ff54999a20bd99a8a33f84d521f0f61a147c4066b385
SHA512af4daf22661244ac6c1e9c340d634bc256969cd2f1ae2a90f2e76b3ed0015e983bfb9941f6de55520ad9204fe0b95590f7c46f933de1565f4e9ed7da24cedbaa
-
Filesize
415KB
MD564bc1983743c584a9ad09dacf12792e5
SHA10f14098f523d21f11129c4df09451413ddff6d61
SHA256057ec356f1577fe86b706e5aeb74e3bdd6fe04d22586fecf69b866f8f72db7f5
SHA5129ab4ddb64bd97dd1a7ee15613a258edf1d2eba880a0896a91487c47a32c9bd1118cde18211053a5b081216d123d5f901b454a525cbba01d8067c31babd8c8c3c
-
Filesize
447KB
MD5d15f5f23df8036bd5089ce8d151b0e0d
SHA14066ff4d92ae189d92fcdfb8c11a82cc9db56bb2
SHA256f2c40dde6f40beaa3c283b66791ff27e6f06d66c8dd6eff5262f51e02ee26520
SHA512feaec8a00346b0a74c530859785e1b280da5833bf3113083bf4664ebee85b14ceca648499f36d266d329d602349f9ad0fc21a10e605377b3a2c24b456f3a9bd9