Analysis
-
max time kernel
32s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
25/08/2023, 12:29
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe
Resource
win7-20230712-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe
Resource
win10v2004-20230824-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe
-
Size
1.2MB
-
MD5
5396f9a4b3baee2f1a1b9448445524d4
-
SHA1
eb203565ce0b33a6b83e9081db6fb45e6e0b07e1
-
SHA256
b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1
-
SHA512
e1967ea8a15d70c239bed37b6c86f50c70325bf79de17970adf59034024e4556ab1e41b48ed9e1c52b3f3c236af0d00fe6125586c3bf38756d3c37777b16b92c
-
SSDEEP
12288:0lSi2oPB+GnrplXVIxJmxwn+/Cg1gPTxGq/GeQgf57jBpGCn:0oyBxnNllInmFgPEKLQ45fB9
Score
8/10
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-2969888527-3102471180-2307688834-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\Disableregistrytools = "1" b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe -
Disables Task Manager via registry modification
-
Modifies file permissions 1 TTPs 1 IoCs
pid Process 9628 takeown.exe -
Modifies system executable filetype association 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe" b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe -
Kills process with taskkill 7 IoCs
pid Process 2496 taskkill.exe 2308 taskkill.exe 584 taskkill.exe 372 taskkill.exe 2080 taskkill.exe 3040 taskkill.exe 628 taskkill.exe -
Modifies registry class 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = "jpegfile" b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe" b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.txt\ = "jpegfile" b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe" b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSystemtimePrivilege 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe Token: SeDebugPrivilege 2080 taskkill.exe Token: SeDebugPrivilege 628 taskkill.exe Token: SeDebugPrivilege 3040 taskkill.exe Token: SeDebugPrivilege 2308 taskkill.exe Token: SeDebugPrivilege 584 taskkill.exe Token: SeDebugPrivilege 372 taskkill.exe Token: SeDebugPrivilege 2496 taskkill.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe Token: SeTakeOwnershipPrivilege 9628 takeown.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe -
Suspicious use of WriteProcessMemory 56 IoCs
description pid Process procid_target PID 2428 wrote to memory of 2496 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 28 PID 2428 wrote to memory of 2496 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 28 PID 2428 wrote to memory of 2496 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 28 PID 2428 wrote to memory of 2496 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 28 PID 2428 wrote to memory of 2496 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 28 PID 2428 wrote to memory of 2496 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 28 PID 2428 wrote to memory of 2496 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 28 PID 2428 wrote to memory of 2308 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 30 PID 2428 wrote to memory of 2308 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 30 PID 2428 wrote to memory of 2308 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 30 PID 2428 wrote to memory of 2308 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 30 PID 2428 wrote to memory of 2308 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 30 PID 2428 wrote to memory of 2308 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 30 PID 2428 wrote to memory of 2308 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 30 PID 2428 wrote to memory of 584 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 32 PID 2428 wrote to memory of 584 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 32 PID 2428 wrote to memory of 584 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 32 PID 2428 wrote to memory of 584 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 32 PID 2428 wrote to memory of 584 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 32 PID 2428 wrote to memory of 584 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 32 PID 2428 wrote to memory of 584 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 32 PID 2428 wrote to memory of 372 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 34 PID 2428 wrote to memory of 372 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 34 PID 2428 wrote to memory of 372 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 34 PID 2428 wrote to memory of 372 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 34 PID 2428 wrote to memory of 372 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 34 PID 2428 wrote to memory of 372 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 34 PID 2428 wrote to memory of 372 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 34 PID 2428 wrote to memory of 628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 40 PID 2428 wrote to memory of 628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 40 PID 2428 wrote to memory of 628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 40 PID 2428 wrote to memory of 628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 40 PID 2428 wrote to memory of 628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 40 PID 2428 wrote to memory of 628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 40 PID 2428 wrote to memory of 628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 40 PID 2428 wrote to memory of 3040 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 38 PID 2428 wrote to memory of 3040 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 38 PID 2428 wrote to memory of 3040 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 38 PID 2428 wrote to memory of 3040 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 38 PID 2428 wrote to memory of 3040 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 38 PID 2428 wrote to memory of 3040 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 38 PID 2428 wrote to memory of 3040 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 38 PID 2428 wrote to memory of 2080 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 35 PID 2428 wrote to memory of 2080 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 35 PID 2428 wrote to memory of 2080 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 35 PID 2428 wrote to memory of 2080 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 35 PID 2428 wrote to memory of 2080 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 35 PID 2428 wrote to memory of 2080 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 35 PID 2428 wrote to memory of 2080 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 35 PID 2428 wrote to memory of 9628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 42 PID 2428 wrote to memory of 9628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 42 PID 2428 wrote to memory of 9628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 42 PID 2428 wrote to memory of 9628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 42 PID 2428 wrote to memory of 9628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 42 PID 2428 wrote to memory of 9628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 42 PID 2428 wrote to memory of 9628 2428 b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe"C:\Users\Admin\AppData\Local\Temp\b63173182f3f2f00b9ae41581579d9515f423b942fd87019d81b99d9451806a1.exe"1⤵
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im kavsvc.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2496
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im qwq.kxp2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2308
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Rav.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:584
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Ravmon.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:372
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im 360tray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2080
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im VsTskMgr.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3040
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im Mcshield.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:628
-
-
C:\Windows\SysWOW64\takeown.exetakeown /f C:\ /r /d y2⤵
- Modifies file permissions
- Suspicious use of AdjustPrivilegeToken
PID:9628
-