Analysis
-
max time kernel
168s -
max time network
140s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
27-08-2023 15:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a2b1ca6b07b686265e9fab1d9e8df0b71da88baf97b17febd443f5a2a5e80f86.exe
Resource
win7-20230712-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
a2b1ca6b07b686265e9fab1d9e8df0b71da88baf97b17febd443f5a2a5e80f86.exe
Resource
win10v2004-20230824-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
a2b1ca6b07b686265e9fab1d9e8df0b71da88baf97b17febd443f5a2a5e80f86.exe
-
Size
3.0MB
-
MD5
7cf245c19260304a201976673c6b2cfc
-
SHA1
b96729f753e2e2d6f5755a54f44c84fa3c8a2532
-
SHA256
a2b1ca6b07b686265e9fab1d9e8df0b71da88baf97b17febd443f5a2a5e80f86
-
SHA512
f40f08548366cd9a89626d7caaf5d62743f7d4b3d2374af01a2610668a076633402ae77b52cd8b15ae3b64e609deb2f6810b8ef7cd76cd6d3c738be8121dbac3
-
SSDEEP
49152:H7TvfU+8X9GrNOsva5RbKhF3ANkTTlWkUSwIaBkgEQDrX:c+8X9G3vP3AMQJSwIa6gtX
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Modifies registry class 5 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3408354897-1169622894-3874090110-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2820 explorer.exe -
Suspicious use of AdjustPrivilegeToken 12 IoCs
description pid Process Token: SeShutdownPrivilege 2820 explorer.exe Token: SeShutdownPrivilege 2820 explorer.exe Token: SeShutdownPrivilege 2820 explorer.exe Token: SeShutdownPrivilege 2820 explorer.exe Token: SeShutdownPrivilege 2820 explorer.exe Token: SeShutdownPrivilege 2820 explorer.exe Token: SeShutdownPrivilege 2820 explorer.exe Token: SeShutdownPrivilege 2820 explorer.exe Token: SeShutdownPrivilege 2820 explorer.exe Token: SeShutdownPrivilege 2820 explorer.exe Token: SeShutdownPrivilege 2820 explorer.exe Token: SeShutdownPrivilege 2820 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe -
Suspicious use of SendNotifyMessage 22 IoCs
pid Process 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe 2820 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2b1ca6b07b686265e9fab1d9e8df0b71da88baf97b17febd443f5a2a5e80f86.exe"C:\Users\Admin\AppData\Local\Temp\a2b1ca6b07b686265e9fab1d9e8df0b71da88baf97b17febd443f5a2a5e80f86.exe"1⤵PID:2256
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2820