0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4

Analysis

max time kernel
122s
max time network
125s
platform
windows7_x64
resource
win7-20230831-en
resource tags

arch:x64arch:x86image:win7-20230831-enlocale:en-usos:windows7-x64system
submitted
07/10/2023, 09:06

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
Size

2.8MB
MD5

f72fd582902f5f15cf9ba14f7c6a2145
SHA1

fb08b0fdbd7457cda3224055faa39976f2b694a9
SHA256

0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4
SHA512

21bb83954c77c5ce8b21f5c4be86a2f56c6ca19c821876d5bc6616aea0bea8436006de6b39b90e68f8ecabb813474a9df7518aec8d4030cc8a83a017bb001fd3
SSDEEP

49152:8YwByTIjy6l9DrMgUVz7Mny53NHuoINYN0RxvYXHK9/CmK/Qqat57/GL:g26l9DrMgUVhPU7WKsmWat5iL

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
3048	SPBBCSvc.exe

Loads dropped DLL 3 IoCs

pid	Process
2984	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
2984	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
2984	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs

pid	Process
3048	SPBBCSvc.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
3048	SPBBCSvc.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	2984	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
Token: SeDebugPrivilege	3048	SPBBCSvc.exe

Suspicious use of SetWindowsHookEx 4 IoCs

pid	Process
2984	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
2984	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
3048	SPBBCSvc.exe
3048	SPBBCSvc.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 2984 wrote to memory of 3048	2984	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe	28
PID 2984 wrote to memory of 3048	2984	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe	28
PID 2984 wrote to memory of 3048	2984	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe	28
PID 2984 wrote to memory of 3048	2984	0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe	28

C:\Users\Admin\AppData\Local\Temp\0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe
"C:\Users\Admin\AppData\Local\Temp\0d9412ad9774c85112e65ec66e7e38e39fc1f380b49647fd613d28241256eff4.exe"
1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2984
- C:\Users\Admin\AppData\Local\Temp\SPBBCSvc.exe
  "C:\Users\Admin\AppData\Local\Temp\SPBBCSvc.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of SetWindowsHookEx
  PID:3048

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\SPBBCSvc.exe

Filesize
2.8MB

MD5
c3951eef10e497d45d5bac01d4b3d22e

SHA1
2f09d03b50f4e25bb49812bd28219e4ca8d85724

SHA256
6a4324d0a9858e4671c812a465cff28b934a8c18661accf756293c37b5641d75

SHA512
b1bc76863018ebefd989ae13f3aaa675969267c92a0b08068de0dc95e1aedcb43eb17ebda55d73a81d94386febe4f2d04458abfb852d8f5e83187b9791ca89f6

Download Submit
C:\Users\Admin\AppData\Local\Temp\SPBBCSvc.exe

Filesize
2.8MB

MD5
c3951eef10e497d45d5bac01d4b3d22e

SHA1
2f09d03b50f4e25bb49812bd28219e4ca8d85724

SHA256
6a4324d0a9858e4671c812a465cff28b934a8c18661accf756293c37b5641d75

SHA512
b1bc76863018ebefd989ae13f3aaa675969267c92a0b08068de0dc95e1aedcb43eb17ebda55d73a81d94386febe4f2d04458abfb852d8f5e83187b9791ca89f6

Download Submit
\Users\Admin\AppData\Local\Temp\SPBBCSvc.exe

Filesize
2.8MB

MD5
c3951eef10e497d45d5bac01d4b3d22e

SHA1
2f09d03b50f4e25bb49812bd28219e4ca8d85724

SHA256
6a4324d0a9858e4671c812a465cff28b934a8c18661accf756293c37b5641d75

SHA512
b1bc76863018ebefd989ae13f3aaa675969267c92a0b08068de0dc95e1aedcb43eb17ebda55d73a81d94386febe4f2d04458abfb852d8f5e83187b9791ca89f6

Download Submit
\Users\Admin\AppData\Local\Temp\SPBBCSvc.exe

Filesize
2.8MB

MD5
c3951eef10e497d45d5bac01d4b3d22e

SHA1
2f09d03b50f4e25bb49812bd28219e4ca8d85724

SHA256
6a4324d0a9858e4671c812a465cff28b934a8c18661accf756293c37b5641d75

SHA512
b1bc76863018ebefd989ae13f3aaa675969267c92a0b08068de0dc95e1aedcb43eb17ebda55d73a81d94386febe4f2d04458abfb852d8f5e83187b9791ca89f6

Download Submit
\Users\Admin\AppData\Local\Temp\SPBBCSvc.exe

Filesize
2.8MB

MD5
c3951eef10e497d45d5bac01d4b3d22e

SHA1
2f09d03b50f4e25bb49812bd28219e4ca8d85724

SHA256
6a4324d0a9858e4671c812a465cff28b934a8c18661accf756293c37b5641d75

SHA512
b1bc76863018ebefd989ae13f3aaa675969267c92a0b08068de0dc95e1aedcb43eb17ebda55d73a81d94386febe4f2d04458abfb852d8f5e83187b9791ca89f6

Download Submit