Analysis
-
max time kernel
142s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20230915-en -
resource tags
arch:x64arch:x86image:win10v2004-20230915-enlocale:en-usos:windows10-2004-x64system -
submitted
07-10-2023 08:22
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe
Resource
win7-20230831-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe
Resource
win10v2004-20230915-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe
-
Size
4.4MB
-
MD5
dd942eb3b1df7394efc0274854db1316
-
SHA1
fdb435add41245e52332814582f1e74171161e13
-
SHA256
811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070
-
SHA512
311287de690c507a63554878314783aab38aaa0913219a941a2abe39893af82f5a8f281a497dc290cc83a465da1cd0d8c2379adc7f6c3524b5597fd630c3ddb3
-
SSDEEP
49152:pKZUvy7IWKv0FtUQJRdkOy62pMMeCtChnoQHCNDKXsrDk6WJ04OQkD:QZUq7YMFtUQJRdKp7eC0ddXNJzA
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 2 IoCs
pid Process 4704 regsvr32.exe 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe -
resource yara_rule behavioral2/memory/4296-1-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-2-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-0-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-3-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-5-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-7-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-9-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-11-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-13-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-15-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-17-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-19-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-21-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-23-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-25-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-27-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-29-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-31-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-33-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-35-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-37-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-39-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-41-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-43-0x0000000003110000-0x000000000314E000-memory.dmp upx behavioral2/memory/4296-52-0x0000000003110000-0x000000000314E000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 35 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\ = "lwcom" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\FLAGS regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1\ = "lwcom" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\ = "lwcom" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CurVer\ = "lw.lwsoft3.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0} regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\VersionIndependentProgID\ = "lw.lwsoft3" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\0 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\FLAGS\ = "0" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1\CLSID\ = "{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\0\win32 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\TypeLib\ = "{71175991-9B59-42EA-B712-9ADF3319AC18}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CLSID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CLSID\ = "{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\ProgID regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\ProgID\ = "lw.lwsoft3.1" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\Programmable regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\InprocServer32\ThreadingModel = "Apartment" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\ = "lwcom" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0\0\win32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lw.dll" regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\TypeLib\version = "1.0" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3\CurVer regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\ = "lwcom" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\TypeLib regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\TypeLib\ = "{71175991-9B59-42EA-B712-9ADF3319AC18}" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3 regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\InprocServer32\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\lw.dll" regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD} regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\Interface\{319E1714-1900-4d95-8900-E95B65A9FDBD}\TypeLib regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\TypeLib\{71175991-9B59-42EA-B712-9ADF3319AC18}\1.0 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\InprocServer32 regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{F6C2EA3D-2A5A-4B63-AFDB-5E24BD1D39A0}\VersionIndependentProgID regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lw.lwsoft3.1\CLSID regsvr32.exe -
Suspicious behavior: EnumeratesProcesses 8 IoCs
pid Process 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 4704 regsvr32.exe Token: 1 4704 regsvr32.exe Token: SeCreateTokenPrivilege 4704 regsvr32.exe Token: SeAssignPrimaryTokenPrivilege 4704 regsvr32.exe Token: SeLockMemoryPrivilege 4704 regsvr32.exe Token: SeIncreaseQuotaPrivilege 4704 regsvr32.exe Token: SeMachineAccountPrivilege 4704 regsvr32.exe Token: SeTcbPrivilege 4704 regsvr32.exe Token: SeSecurityPrivilege 4704 regsvr32.exe Token: SeTakeOwnershipPrivilege 4704 regsvr32.exe Token: SeLoadDriverPrivilege 4704 regsvr32.exe Token: SeSystemProfilePrivilege 4704 regsvr32.exe Token: SeSystemtimePrivilege 4704 regsvr32.exe Token: SeProfSingleProcessPrivilege 4704 regsvr32.exe Token: SeIncBasePriorityPrivilege 4704 regsvr32.exe Token: SeCreatePagefilePrivilege 4704 regsvr32.exe Token: SeCreatePermanentPrivilege 4704 regsvr32.exe Token: SeBackupPrivilege 4704 regsvr32.exe Token: SeRestorePrivilege 4704 regsvr32.exe Token: SeShutdownPrivilege 4704 regsvr32.exe Token: SeDebugPrivilege 4704 regsvr32.exe Token: SeAuditPrivilege 4704 regsvr32.exe Token: SeSystemEnvironmentPrivilege 4704 regsvr32.exe Token: SeChangeNotifyPrivilege 4704 regsvr32.exe Token: SeRemoteShutdownPrivilege 4704 regsvr32.exe Token: SeUndockPrivilege 4704 regsvr32.exe Token: SeSyncAgentPrivilege 4704 regsvr32.exe Token: SeEnableDelegationPrivilege 4704 regsvr32.exe Token: SeManageVolumePrivilege 4704 regsvr32.exe Token: SeImpersonatePrivilege 4704 regsvr32.exe Token: SeCreateGlobalPrivilege 4704 regsvr32.exe Token: 31 4704 regsvr32.exe Token: 32 4704 regsvr32.exe Token: 33 4704 regsvr32.exe Token: 34 4704 regsvr32.exe Token: 35 4704 regsvr32.exe Token: 36 4704 regsvr32.exe Token: 37 4704 regsvr32.exe Token: 38 4704 regsvr32.exe Token: 39 4704 regsvr32.exe Token: 40 4704 regsvr32.exe Token: 41 4704 regsvr32.exe Token: 42 4704 regsvr32.exe Token: 43 4704 regsvr32.exe Token: 44 4704 regsvr32.exe Token: 45 4704 regsvr32.exe Token: 46 4704 regsvr32.exe Token: 47 4704 regsvr32.exe Token: 48 4704 regsvr32.exe Token: SeDebugPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: 1 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeCreateTokenPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeAssignPrimaryTokenPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeLockMemoryPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeIncreaseQuotaPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeMachineAccountPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeTcbPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeSecurityPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeTakeOwnershipPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeLoadDriverPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeSystemProfilePrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeSystemtimePrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeProfSingleProcessPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe Token: SeIncBasePriorityPrivilege 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4296 wrote to memory of 4704 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 87 PID 4296 wrote to memory of 4704 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 87 PID 4296 wrote to memory of 4704 4296 811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe"C:\Users\Admin\AppData\Local\Temp\811f01552b1c5be4a04216d9bde32a65087c87674ca543d12f1f4f6114c4b070.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\regsvr32.exeregsvr32 C:\Users\Admin\AppData\Local\Temp\lw.dll -s2⤵
- Loads dropped DLL
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:4704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.5MB
MD5dfa6eb62c2cfbc3410113a0601bdcb86
SHA1a5f5e109ddf06ead3edfd55a61a0daef9905a32b
SHA256ac521283982bade625a6bc5c1ad5b43d70461da21754f0919967a4f4e5fd60f5
SHA512fead01a4626d0d8c7e3c2becfbcf3b88a519453fa82ed84026a3c576c64957776a8cb3a64ce67d4b4b210eb61b592de537252c6814aa968c2459a9b04c793d63
-
Filesize
2.5MB
MD5dfa6eb62c2cfbc3410113a0601bdcb86
SHA1a5f5e109ddf06ead3edfd55a61a0daef9905a32b
SHA256ac521283982bade625a6bc5c1ad5b43d70461da21754f0919967a4f4e5fd60f5
SHA512fead01a4626d0d8c7e3c2becfbcf3b88a519453fa82ed84026a3c576c64957776a8cb3a64ce67d4b4b210eb61b592de537252c6814aa968c2459a9b04c793d63
-
Filesize
2.5MB
MD5dfa6eb62c2cfbc3410113a0601bdcb86
SHA1a5f5e109ddf06ead3edfd55a61a0daef9905a32b
SHA256ac521283982bade625a6bc5c1ad5b43d70461da21754f0919967a4f4e5fd60f5
SHA512fead01a4626d0d8c7e3c2becfbcf3b88a519453fa82ed84026a3c576c64957776a8cb3a64ce67d4b4b210eb61b592de537252c6814aa968c2459a9b04c793d63