e7dc898ccd297cc19a6f8dd0e670b882f459859f268087a7abf42c89d1e5fe1e

Analysis

max time kernel
135s
max time network
135s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
02-10-2023 11:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe
Size

20.4MB
MD5

592760f1bf193ba979086f33f8dddb12
SHA1

5b14cb8a3913f1e6a98fe1ac78123b4f97bc53ec
SHA256

227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727
SHA512

086a933c3f7036746340649d235b3bf8a2d687c16ee99e67dbfc3fe6e8984b18f8983c49d5b325eef018738d85c538d085edd958276420113f6cbf17f232ed34
SSDEEP

393216:6moQtYN97oQOC2aDhFq5YUvBvv+MwiE9ryM/y+76LGgWBiI8Z2es70QhOkjwhXec:KQtbQOC2aDGY8vv+Mwf/yJGR4Z2eswks

Score

7^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2748	signtool.exe

Loads dropped DLL 2 IoCs

pid	Process
3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe
3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe

UPX packed file 4 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/3032-0-0x0000000000400000-0x0000000001A2D000-memory.dmp	upx
behavioral1/memory/3032-70-0x0000000000400000-0x0000000001A2D000-memory.dmp	upx
behavioral1/memory/3032-71-0x0000000000400000-0x0000000001A2D000-memory.dmp	upx
behavioral1/memory/3032-72-0x0000000000400000-0x0000000001A2D000-memory.dmp	upx

Modifies system certificate store 2 TTPs 2 IoCs

evasion spyware trojan

Install Root Certificate

T1553.004

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C	signtool.exe
Set value (data)	\REGISTRY\USER\S-1-5-21-3750544865-3773649541-1858556521-1000\Software\Microsoft\SystemCertificates\CA\Certificates\D89E3BD43D5D909B47A18977AA9D5CE36CEE184C\Blob = 030000000100000014000000d89e3bd43d5d909b47a18977aa9d5ce36cee184c1400000001000000140000005379bf5aaa2b4acf5480e1d89bc09df2b20366cb040000000100000010000000285ec909c4ab0d2d57f5086b225799aa0f000000010000003000000013baa039635f1c5292a8c2f36aae7e1d25c025202e9092f5b0f53f5f752dfa9c71b3d1b8d9a6358fcee6ec75622fabf9190000000100000010000000ea6089055218053dd01e37e1d806eedf1800000001000000100000002aa1c05e2ae606f198c2c5e937c97aa22000000001000000850500003082058130820469a00302010202103972443af922b751d7d36c10dd313595300d06092a864886f70d01010c0500307b310b3009060355040613024742311b301906035504080c1247726561746572204d616e636865737465723110300e06035504070c0753616c666f7264311a3018060355040a0c11436f6d6f646f204341204c696d697465643121301f06035504030c18414141204365727469666963617465205365727669636573301e170d3139303331323030303030305a170d3238313233313233353935395a308188310b3009060355040613025553311330110603550408130a4e6577204a6572736579311430120603550407130b4a65727365792043697479311e301c060355040a131554686520555345525452555354204e6574776f726b312e302c06035504031325555345525472757374205253412043657274696669636174696f6e20417574686f7269747930820222300d06092a864886f70d01010105000382020f003082020a028202010080126517360ec3db08b3d0ac570d76edcd27d34cad508361e2aa204d092d6409dcce899fcc3da9ecf6cfc1dcf1d3b1d67b3728112b47da39c6bc3a19b45fa6bd7d9da36342b676f2a93b2b91f8e26fd0ec162090093ee2e874c918b491d46264db7fa306f188186a90223cbcfe13f087147bf6e41f8ed4e451c61167460851cb8614543fbc33fe7e6c9cff169d18bd518e35a6a766c87267db2166b1d49b7803c0503ae8ccf0dcbc9e4cfeaf0596351f575ab7ffcef93db72cb6f654ddc8e7123a4dae4c8ab75c9ab4b7203dca7f2234ae7e3b68660144e7014e46539b3360f794be5337907343f332c353efdbaafe744e69c76b8c6093dec4c70cdfe132aecc933b517895678bee3d56fe0cd0690f1b0ff325266b336df76e47fa7343e57e0ea566b1297c3284635589c40dc19354301913acd37d37a7eb5d3a6c355cdb41d712daa9490bdfd8808a0993628eb566cf2588cd84b8b13fa4390fd9029eeb124c957cf36b05a95e1683ccb867e2e8139dcc5b82d34cb3ed5bffdee573ac233b2d00bf3555740949d849581a7f9236e651920ef3267d1c4d17bcc9ec4326d0bf415f40a94444f499e757879e501f5754a83efd74632fb1506509e658422e431a4cb4f0254759fa041e93d426464a5081b2debe78b7fc6715e1c957841e0f63d6e962bad65f552eea5cc62808042539b80e2ba9f24c971c073f0d52f5edef2f820f0203010001a381f23081ef301f0603551d23041830168014a0110a233e96f107ece2af29ef82a57fd030a4b4301d0603551d0e041604145379bf5aaa2b4acf5480e1d89bc09df2b20366cb300e0603551d0f0101ff040403020186300f0603551d130101ff040530030101ff30110603551d20040a300830060604551d200030430603551d1f043c303a3038a036a0348632687474703a2f2f63726c2e636f6d6f646f63612e636f6d2f414141436572746966696361746553657276696365732e63726c303406082b0601050507010104283026302406082b060105050730018618687474703a2f2f6f6373702e636f6d6f646f63612e636f6d300d06092a864886f70d01010c05000382010100188751dc74213d9c8ae027b733d02eccecf0e6cb5e11de226f9b758e9e72fee4d6feaa1f9c962def034a7eaef48d6f723c433bc03febb8df5caaa9c6aef2fcd8eea37b43f686367c14e0cdf4f73ffedeb8b48af09196fefd43647efdccd201a17d7df81919c9422b13bf588bbaa4a266047688914e0c8914cea24dc932b3bae8141abc71f15bf0410b98000a220310e50cb1f9cd923719ed3bf1e43ab6f945132675afbbaaef3f7b773bd2c402913d1900d3175c39db3f7b180d45cd9385962f5ddf59164f3f51bdd545183fed4a8ee80661742316b50d50732744477f105d892a6b853114c4e8a96a4c80bc6a78cfb87f8e7672990c9dfed7910816a1a35f95	signtool.exe

Suspicious use of AdjustPrivilegeToken 40 IoCs

description	pid	Process
Token: SeIncreaseQuotaPrivilege	2648	wmic.exe
Token: SeSecurityPrivilege	2648	wmic.exe
Token: SeTakeOwnershipPrivilege	2648	wmic.exe
Token: SeLoadDriverPrivilege	2648	wmic.exe
Token: SeSystemProfilePrivilege	2648	wmic.exe
Token: SeSystemtimePrivilege	2648	wmic.exe
Token: SeProfSingleProcessPrivilege	2648	wmic.exe
Token: SeIncBasePriorityPrivilege	2648	wmic.exe
Token: SeCreatePagefilePrivilege	2648	wmic.exe
Token: SeBackupPrivilege	2648	wmic.exe
Token: SeRestorePrivilege	2648	wmic.exe
Token: SeShutdownPrivilege	2648	wmic.exe
Token: SeDebugPrivilege	2648	wmic.exe
Token: SeSystemEnvironmentPrivilege	2648	wmic.exe
Token: SeRemoteShutdownPrivilege	2648	wmic.exe
Token: SeUndockPrivilege	2648	wmic.exe
Token: SeManageVolumePrivilege	2648	wmic.exe
Token: 33	2648	wmic.exe
Token: 34	2648	wmic.exe
Token: 35	2648	wmic.exe
Token: SeIncreaseQuotaPrivilege	2648	wmic.exe
Token: SeSecurityPrivilege	2648	wmic.exe
Token: SeTakeOwnershipPrivilege	2648	wmic.exe
Token: SeLoadDriverPrivilege	2648	wmic.exe
Token: SeSystemProfilePrivilege	2648	wmic.exe
Token: SeSystemtimePrivilege	2648	wmic.exe
Token: SeProfSingleProcessPrivilege	2648	wmic.exe
Token: SeIncBasePriorityPrivilege	2648	wmic.exe
Token: SeCreatePagefilePrivilege	2648	wmic.exe
Token: SeBackupPrivilege	2648	wmic.exe
Token: SeRestorePrivilege	2648	wmic.exe
Token: SeShutdownPrivilege	2648	wmic.exe
Token: SeDebugPrivilege	2648	wmic.exe
Token: SeSystemEnvironmentPrivilege	2648	wmic.exe
Token: SeRemoteShutdownPrivilege	2648	wmic.exe
Token: SeUndockPrivilege	2648	wmic.exe
Token: SeManageVolumePrivilege	2648	wmic.exe
Token: 33	2648	wmic.exe
Token: 34	2648	wmic.exe
Token: 35	2648	wmic.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe
3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe
3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 3032 wrote to memory of 3068	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	28
PID 3032 wrote to memory of 3068	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	28
PID 3032 wrote to memory of 3068	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	28
PID 3032 wrote to memory of 3068	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	28
PID 3032 wrote to memory of 2748	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	30
PID 3032 wrote to memory of 2748	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	30
PID 3032 wrote to memory of 2748	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	30
PID 3032 wrote to memory of 2748	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	30
PID 3032 wrote to memory of 2648	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	32
PID 3032 wrote to memory of 2648	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	32
PID 3032 wrote to memory of 2648	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	32
PID 3032 wrote to memory of 2648	3032	227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe	32

C:\Users\Admin\AppData\Local\Temp\227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe
"C:\Users\Admin\AppData\Local\Temp\227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe"
1⤵
- Loads dropped DLL
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3032
- C:\Windows\system32\cmd.exe
  "C:\Windows\Sysnative\cmd.exe" /c copy C:\Windows\system32\Tasks\KMSAuto "C:\Users\Admin\AppData\Local\Temp\KMSAuto.tmp" /Y
  2⤵
  PID:3068
- C:\Users\Admin\AppData\Local\Temp\signtool.exe
  "C:\Users\Admin\AppData\Local\Temp\signtool.exe" verify /v /ph /sha1 648384a4dee53d4c1c87e10d67cc99307ccc9c98 "C:\Users\Admin\AppData\Local\Temp\227305b6487176b3a5184e84ebec6f6f392b4aada59dab057d9ea538c4394727.exe"
  2⤵
  - Executes dropped EXE
  - Modifies system certificate store
  PID:2748
- C:\Windows\SysWOW64\Wbem\wmic.exe
  "wmic.exe" path Win32_NetworkAdapter get ServiceName /value /FORMAT:List
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:2648

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Subvert Trust Controls

T1553

Install Root Certificate

T1553.004

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\Cab5034.tmp

Filesize
61KB

MD5
f3441b8572aae8801c04f3060b550443

SHA1
4ef0a35436125d6821831ef36c28ffaf196cda15

SHA256
6720349e7d82ee0a8e73920d3c2b7cb2912d9fcf2edb6fd98f2f12820158b0bf

SHA512
5ba01ba421b50030e380ae6bbcd2f681f2a91947fe7fedb3c8e6b5f24dce9517abf57b1cf26cc6078d4bb53bde6fcfb2561591337c841f8f2cb121a3d71661b9

Download Submit
C:\Users\Admin\AppData\Local\Temp\Tar50D3.tmp

Filesize
163KB

MD5
9441737383d21192400eca82fda910ec

SHA1
725e0d606a4fc9ba44aa8ffde65bed15e65367e4

SHA256
bc3a6e84e41faeb57e7c21aa3b60c2a64777107009727c5b7c0ed8fe658909e5

SHA512
7608dd653a66cd364392a78d4711b48d1707768d36996e4d38871c6843b5714e1d7da4b4cc6db969e6000cfa182bcb74216ef6823d1063f036fc5c3413fb8dcf

Download Submit
C:\Users\Admin\AppData\Local\Temp\signtool.exe

Filesize
323KB

MD5
05624e6d27eaef0db0673ae627bd6027

SHA1
b155c76bf59992a8d75d0e3a59dc94f24aff2591

SHA256
962a92821f54a1e706aa989973130fdc1072c7bd8b9e6d11ea1050b46eb9d313

SHA512
233304669aefeec9ad5d19bd2dd5bb19ea35ce31da0b3aabe5ab859259608a58725fac5993637c9635e5912138d3eb477773351f0ee81cc3ce756d713163cf31

Download Submit
C:\Users\Admin\AppData\Local\Temp\signtool.exe

Filesize
323KB

MD5
05624e6d27eaef0db0673ae627bd6027

SHA1
b155c76bf59992a8d75d0e3a59dc94f24aff2591

SHA256
962a92821f54a1e706aa989973130fdc1072c7bd8b9e6d11ea1050b46eb9d313

SHA512
233304669aefeec9ad5d19bd2dd5bb19ea35ce31da0b3aabe5ab859259608a58725fac5993637c9635e5912138d3eb477773351f0ee81cc3ce756d713163cf31

Download Submit
\Users\Admin\AppData\Local\Temp\signtool.exe

Filesize
323KB

MD5
05624e6d27eaef0db0673ae627bd6027

SHA1
b155c76bf59992a8d75d0e3a59dc94f24aff2591

SHA256
962a92821f54a1e706aa989973130fdc1072c7bd8b9e6d11ea1050b46eb9d313

SHA512
233304669aefeec9ad5d19bd2dd5bb19ea35ce31da0b3aabe5ab859259608a58725fac5993637c9635e5912138d3eb477773351f0ee81cc3ce756d713163cf31

Download Submit
\Users\Admin\AppData\Local\Temp\signtool.exe

Filesize
323KB

MD5
05624e6d27eaef0db0673ae627bd6027

SHA1
b155c76bf59992a8d75d0e3a59dc94f24aff2591

SHA256
962a92821f54a1e706aa989973130fdc1072c7bd8b9e6d11ea1050b46eb9d313

SHA512
233304669aefeec9ad5d19bd2dd5bb19ea35ce31da0b3aabe5ab859259608a58725fac5993637c9635e5912138d3eb477773351f0ee81cc3ce756d713163cf31

Download Submit
memory/3032-0-0x0000000000400000-0x0000000001A2D000-memory.dmp

Filesize
22.2MB

Download
memory/3032-70-0x0000000000400000-0x0000000001A2D000-memory.dmp

Filesize
22.2MB

Download
memory/3032-71-0x0000000000400000-0x0000000001A2D000-memory.dmp

Filesize
22.2MB

Download
memory/3032-72-0x0000000000400000-0x0000000001A2D000-memory.dmp

Filesize
22.2MB

Download