Analysis

  • max time kernel
    139s
  • max time network
    128s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    20/12/2023, 15:47

General

  • Target

    dd2e2cf10a41a07faa2bfc890a30ef28.exe

  • Size

    6.9MB

  • MD5

    dd2e2cf10a41a07faa2bfc890a30ef28

  • SHA1

    fc9e90c465f8457f8e0cff8fdac85b412c09d7e1

  • SHA256

    57926c629184179f9f15f942b791bd36bfec63e28b87dd7b2f701b878bba7df4

  • SHA512

    ec7da112c4d574bd78aed1648c1586e6eeb851bc7cb9d29969a779cda5eb98ea1709da19dce0ded19192f96c959a7e5af872ad704c16ebb86be759931ca3f53b

  • SSDEEP

    196608:fOKzCPwaYLFn9WpTIA6qmF5RZLL9wVzSyUCIQ:f3CHMFApcA69Pn9qSy1

Score
7/10

Malware Config

Signatures

  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 3 IoCs
  • VMProtect packed file 2 IoCs

    Detects executables packed with VMProtect commercial packer.

  • Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
  • Enumerates physical storage devices 1 TTPs

    Attempts to interact with connected storage/optical drive(s).

  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 22 IoCs
  • Uses Task Scheduler COM API 1 TTPs

    The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.

Processes

  • C:\Users\Admin\AppData\Local\Temp\dd2e2cf10a41a07faa2bfc890a30ef28.exe
    "C:\Users\Admin\AppData\Local\Temp\dd2e2cf10a41a07faa2bfc890a30ef28.exe"
    1⤵
    • Loads dropped DLL
    • Suspicious use of NtSetInformationThreadHideFromDebugger
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:660
    • C:\Users\Admin\AppData\Roaming\msconfig.exe
      "C:\Users\Admin\AppData\Roaming\msconfig.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1720
      • C:\Windows\System32\cmd.exe
        "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"' & exit
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3008
        • C:\Windows\system32\schtasks.exe
          schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"'
          4⤵
          • Creates scheduled task(s)
          PID:2804
      • C:\Users\Admin\AppData\Local\Temp\services32.exe
        "C:\Users\Admin\AppData\Local\Temp\services32.exe"
        3⤵
        • Executes dropped EXE
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:2960
        • C:\Windows\System32\cmd.exe
          "C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"' & exit
          4⤵
          • Suspicious use of WriteProcessMemory
          PID:2928
          • C:\Windows\system32\schtasks.exe
            schtasks /create /f /sc onlogon /rl highest /tn "services32" /tr '"C:\Users\Admin\AppData\Local\Temp\services32.exe"'
            5⤵
            • Creates scheduled task(s)
            PID:112
        • C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe
          "C:\Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe"
          4⤵
          • Executes dropped EXE
          PID:2956

Network

        MITRE ATT&CK Enterprise v15

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Users\Admin\AppData\Local\Temp\services32.exe

          Filesize

          1.9MB

          MD5

          0be8b762903b2a90843b9c3e3db3b471

          SHA1

          e7cf9bcb4c809340ebbd9aeb09bcb76e6468552a

          SHA256

          a937d5e7a70b9c789df57de34f41595107a6277fe4150190363d9661e7b96b3f

          SHA512

          31e44025376097f88f36430e83e08b9457b9e45a44e9b6f5737da0cf5dc339f69a0fd3f015877391a2c5b24dc3f0b3ecb86cd049b1237b11fd4b9b19a3c9dc3b

        • C:\Users\Admin\AppData\Local\Temp\services32.exe

          Filesize

          864KB

          MD5

          23d0f836b2960d74d4d1dac9c3405b66

          SHA1

          1b092d1891c5bb6c7f1452127b72f14b4c2c1f79

          SHA256

          5e314bfe4bb54d4f8ae6094bcff31e8c9b75770ca143eec71b6105af02b6eef2

          SHA512

          83a0385f619b2da13f78c8c341f55020cf96cc30cdda2ea73b9dad34ae512387e1fd2e0dce33eb14c0b9bda438a0c03ea3535a4e62020f693946d2696f533219

        • C:\Users\Admin\AppData\Local\Temp\services32.exe

          Filesize

          826KB

          MD5

          ddbd9ebdd46645157a0eb34edab4358d

          SHA1

          89a3f4a367f6fd97f4fd4cb457c2db30bbd6c1bb

          SHA256

          1a35de0fe3cb2b85de3ca0a41606f9db79ea788fab8254bb59f239c2ab901c3c

          SHA512

          db1debf82bc7d5b68302004abc9430494286d06029a046f2390578b11a5b5e6525adac0a17a525a92945d18440a4bf2e2013a256e6288fc29e003f42e2a1f092

        • C:\Users\Admin\AppData\Roaming\msconfig.exe

          Filesize

          1.4MB

          MD5

          5f102f5f09eca1ad0ffec009117b559c

          SHA1

          509b72a2ed190f90263d7e2eb37b5f854137e55c

          SHA256

          e1dbce579b50c0b06b3caa454aa4c1396dac05409d33a2b5790456d6a578548e

          SHA512

          8a06d8a2be8c1f7995818c52ea099e8d6f358cebdb07f3c270d69a27ce64f348639a1422f06f8460947688e0eebd275857ea8820eaa5e900ad4d95d8fd885025

        • C:\Users\Admin\AppData\Roaming\msconfig.exe

          Filesize

          1.5MB

          MD5

          918a85170b64242730f12ee6fbac0fa2

          SHA1

          4efbd541664dd987931e3e6c0bd3cb45ccaa8dbb

          SHA256

          8a7501ca02a7b8e8bbb3693e41fb256e4ee5f5e70cb6fc3f60adc8995240e560

          SHA512

          c1164b55974bb20c31b578b8f0a485c9493f734a5a1d24322728e4e033da0faa7fc7b870e0a94b725f8ab073ab0eaf9da4cc2ce7736957ce3c7acd2c9f250d1c

        • \Users\Admin\AppData\Local\Temp\services32.exe

          Filesize

          1.1MB

          MD5

          247760a2ca78500ed2c87d7e9612436e

          SHA1

          d917191a62c9497ad793f5571265ae45724ca4b2

          SHA256

          005e044eb04a89bdd032b41d0894c34c585dbd3c8a34ce58a69745c2232f1f02

          SHA512

          c78660585df3a21c7a5cd7d934b3d0a823a68790a00f7e959e00a26294cbdfe1b70da71c0e5e5291df93d5883a739b7efb033e5f0cc7f2760e968fee647f3ef9

        • \Users\Admin\AppData\Roaming\Microsoft\Telemetry\sihost32.exe

          Filesize

          8KB

          MD5

          1415d3cef8766b64044d48804587e97d

          SHA1

          4d5d324dc95cacfffe08a30096c95892ae22660e

          SHA256

          530f0f19333c1b89a59017b7728d0128514f1f18705af48cb4428f87bf833849

          SHA512

          48d0d3ea6abaaf2ed94aceea28ff4de0b8d823de5e35641860e7c9736f860c8491087d5e9a6a108a50e82db8ce0e4cf33efc3d4a390368618939cf92cf594765

        • \Users\Admin\AppData\Roaming\msconfig.exe

          Filesize

          919KB

          MD5

          979861237c93e9a7847102eac3f35f25

          SHA1

          6cf8339b30cf877d5160ba39c799a5dda57e15d5

          SHA256

          7c4005388b4aca10385a690a4059758265012b27dccb13ee82f588cee30e6c9a

          SHA512

          24ef07e62b711195c0bddf62101df0d25e45a93dd85efe831d1b081a1011723b852b030eaa3842f3528ebac841e4fca6c4caff1450a69d002dca5998053376a7

        • memory/660-2-0x0000000000400000-0x0000000000AE3000-memory.dmp

          Filesize

          6.9MB

        • memory/660-0-0x00000000000F0000-0x00000000000F1000-memory.dmp

          Filesize

          4KB

        • memory/660-6-0x0000000000400000-0x0000000000AE3000-memory.dmp

          Filesize

          6.9MB

        • memory/660-3-0x00000000000F0000-0x00000000000F1000-memory.dmp

          Filesize

          4KB

        • memory/660-5-0x00000000000F0000-0x00000000000F1000-memory.dmp

          Filesize

          4KB

        • memory/1720-24-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

          Filesize

          9.9MB

        • memory/1720-15-0x0000000002200000-0x0000000002280000-memory.dmp

          Filesize

          512KB

        • memory/1720-16-0x000000001BC40000-0x000000001BE2A000-memory.dmp

          Filesize

          1.9MB

        • memory/1720-13-0x000000013FBA0000-0x000000013FD8C000-memory.dmp

          Filesize

          1.9MB

        • memory/1720-14-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

          Filesize

          9.9MB

        • memory/2956-33-0x000000013F360000-0x000000013F366000-memory.dmp

          Filesize

          24KB

        • memory/2956-34-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

          Filesize

          9.9MB

        • memory/2956-35-0x0000000002460000-0x00000000024E0000-memory.dmp

          Filesize

          512KB

        • memory/2956-38-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

          Filesize

          9.9MB

        • memory/2956-39-0x0000000002460000-0x00000000024E0000-memory.dmp

          Filesize

          512KB

        • memory/2960-25-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

          Filesize

          9.9MB

        • memory/2960-26-0x000000001B8A0000-0x000000001B920000-memory.dmp

          Filesize

          512KB

        • memory/2960-23-0x000000013F850000-0x000000013FA3C000-memory.dmp

          Filesize

          1.9MB

        • memory/2960-36-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

          Filesize

          9.9MB

        • memory/2960-37-0x000007FEF57D0000-0x000007FEF61BC000-memory.dmp

          Filesize

          9.9MB