Analysis
-
max time kernel
120s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24/12/2023, 23:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1a35c876cec9dd9882ad6fbb00ad8cec.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
1a35c876cec9dd9882ad6fbb00ad8cec.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
1a35c876cec9dd9882ad6fbb00ad8cec.exe
-
Size
1.0MB
-
MD5
1a35c876cec9dd9882ad6fbb00ad8cec
-
SHA1
328292a8d839f1ff7be8711c3f5ae58add04fd0f
-
SHA256
d4808f16c7a021bb8136de7b3465fcea4f791e7c39d48273723c8d0b72bbabd4
-
SHA512
73985690eb79b4836e16bb9fed270370eb8e9d16ba84a9dfba43fee25038153a30742988a96b87afbf66ffee88b5920d0ffb9da06c3eb297b35973d518b2b3d8
-
SSDEEP
24576:hz5y8dMeWB97t1WzI0n4O5OgXMLxwrbwb/t9C+U0T9HC:ha7xBdwrbmFnTg
Score
10/10
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" 1a35c876cec9dd9882ad6fbb00ad8cec.exe -
Loads dropped DLL 1 IoCs
pid Process 1044 1a35c876cec9dd9882ad6fbb00ad8cec.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Windows\\System32\\D09987h.exe" 1a35c876cec9dd9882ad6fbb00ad8cec.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File opened for modification C:\windows\SysWOW64\comp.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\hdwwiz.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\mfpmp.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\setup16.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\setupSNK.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\certreq.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\diskraid.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\dnscacheugc.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\ocsetup.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\recover.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\regedit.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\Windows\SysWOW64\D09987h.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\bthudtask.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\dpapimig.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\schtasks.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\ddodiag.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\icsunattend.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\tracerpt.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\unlodctr.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\wscript.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\convert.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\dfrgui.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\DWWIN.EXE 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\gpscript.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\hh.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\chkdsk.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\makecab.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\SndVol.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\sort.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\wusa.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\extrac32.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\fc.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\findstr.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\sdchange.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\tzutil.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\WerFault.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\at.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\doskey.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\drvinst.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\driverquery.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\icardagt.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\regedt32.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\SystemPropertiesComputerName.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\dialer.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\diantz.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\sfc.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\compact.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\InfDefaultInstall.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\openfiles.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\RpcPing.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\sethc.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\wowreg32.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\cmstp.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\dccw.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\dxdiag.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\eventvwr.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\pcaui.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\SystemPropertiesDataExecutionPrevention.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\dplaysvr.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\EhStorAuthn.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\help.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\shrpubw.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\TsWpfWrp.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe File opened for modification C:\windows\SysWOW64\verifier.exe 1a35c876cec9dd9882ad6fbb00ad8cec.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1044 wrote to memory of 2680 1044 1a35c876cec9dd9882ad6fbb00ad8cec.exe 28 PID 1044 wrote to memory of 2680 1044 1a35c876cec9dd9882ad6fbb00ad8cec.exe 28 PID 1044 wrote to memory of 2680 1044 1a35c876cec9dd9882ad6fbb00ad8cec.exe 28 PID 1044 wrote to memory of 2680 1044 1a35c876cec9dd9882ad6fbb00ad8cec.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a35c876cec9dd9882ad6fbb00ad8cec.exe"C:\Users\Admin\AppData\Local\Temp\1a35c876cec9dd9882ad6fbb00ad8cec.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Users\Admin\AppData\Local\Temp\1a35c876cec9dd9882ad6fbb00ad8cec.exe"C:\Users\Admin\AppData\Local\Temp\1a35c876cec9dd9882ad6fbb00ad8cec.exe"2⤵PID:2680
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.0MB
MD51a35c876cec9dd9882ad6fbb00ad8cec
SHA1328292a8d839f1ff7be8711c3f5ae58add04fd0f
SHA256d4808f16c7a021bb8136de7b3465fcea4f791e7c39d48273723c8d0b72bbabd4
SHA51273985690eb79b4836e16bb9fed270370eb8e9d16ba84a9dfba43fee25038153a30742988a96b87afbf66ffee88b5920d0ffb9da06c3eb297b35973d518b2b3d8