Analysis
-
max time kernel
150s -
max time network
137s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-12-2023 14:37
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
017a951c19ca633ac332f7737497434f.exe
Resource
win7-20231215-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
017a951c19ca633ac332f7737497434f.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
017a951c19ca633ac332f7737497434f.exe
-
Size
313KB
-
MD5
017a951c19ca633ac332f7737497434f
-
SHA1
da6652947282770608d507857e637371658edffb
-
SHA256
e5c39ac59199c5b5a6df47f3bb3a2e6eec2ec8b15b556de2086bd0187c6edcb3
-
SHA512
44c6c793d34f5c119d47d33d640aec6b8d78918cc845b21fa24d29426ce968f8fb56a95df6722d422cb6c4536cae4bbc32a4709b65c320b8c7c37ee6068822aa
-
SSDEEP
6144:jr/HSjn3r7pb0D2tY4fPQvQrhOgaaCNXtKrmXWgfE+WueNfqYDr5Gx:XyjnbOD2qvcOgaNNAitf1zehzP
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 1704 jLbBnIiPmLe16645.exe -
Executes dropped EXE 1 IoCs
pid Process 1704 jLbBnIiPmLe16645.exe -
Loads dropped DLL 2 IoCs
pid Process 2792 017a951c19ca633ac332f7737497434f.exe 2792 017a951c19ca633ac332f7737497434f.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\jLbBnIiPmLe16645 = "C:\\ProgramData\\jLbBnIiPmLe16645\\jLbBnIiPmLe16645.exe" jLbBnIiPmLe16645.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\K: jLbBnIiPmLe16645.exe File opened (read-only) \??\L: jLbBnIiPmLe16645.exe File opened (read-only) \??\N: jLbBnIiPmLe16645.exe File opened (read-only) \??\P: jLbBnIiPmLe16645.exe File opened (read-only) \??\G: jLbBnIiPmLe16645.exe File opened (read-only) \??\J: jLbBnIiPmLe16645.exe File opened (read-only) \??\S: jLbBnIiPmLe16645.exe File opened (read-only) \??\W: jLbBnIiPmLe16645.exe File opened (read-only) \??\X: jLbBnIiPmLe16645.exe File opened (read-only) \??\H: jLbBnIiPmLe16645.exe File opened (read-only) \??\M: jLbBnIiPmLe16645.exe File opened (read-only) \??\R: jLbBnIiPmLe16645.exe File opened (read-only) \??\T: jLbBnIiPmLe16645.exe File opened (read-only) \??\U: jLbBnIiPmLe16645.exe File opened (read-only) \??\Y: jLbBnIiPmLe16645.exe File opened (read-only) \??\E: jLbBnIiPmLe16645.exe File opened (read-only) \??\I: jLbBnIiPmLe16645.exe File opened (read-only) \??\O: jLbBnIiPmLe16645.exe File opened (read-only) \??\Q: jLbBnIiPmLe16645.exe File opened (read-only) \??\V: jLbBnIiPmLe16645.exe File opened (read-only) \??\Z: jLbBnIiPmLe16645.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Internet Explorer\Main jLbBnIiPmLe16645.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2792 017a951c19ca633ac332f7737497434f.exe 2792 017a951c19ca633ac332f7737497434f.exe 2792 017a951c19ca633ac332f7737497434f.exe 2792 017a951c19ca633ac332f7737497434f.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe 2792 017a951c19ca633ac332f7737497434f.exe 1704 jLbBnIiPmLe16645.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2792 017a951c19ca633ac332f7737497434f.exe Token: SeDebugPrivilege 1704 jLbBnIiPmLe16645.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1704 jLbBnIiPmLe16645.exe 1704 jLbBnIiPmLe16645.exe -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1704 jLbBnIiPmLe16645.exe 1704 jLbBnIiPmLe16645.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1704 jLbBnIiPmLe16645.exe 1704 jLbBnIiPmLe16645.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2792 wrote to memory of 1704 2792 017a951c19ca633ac332f7737497434f.exe 28 PID 2792 wrote to memory of 1704 2792 017a951c19ca633ac332f7737497434f.exe 28 PID 2792 wrote to memory of 1704 2792 017a951c19ca633ac332f7737497434f.exe 28 PID 2792 wrote to memory of 1704 2792 017a951c19ca633ac332f7737497434f.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\017a951c19ca633ac332f7737497434f.exe"C:\Users\Admin\AppData\Local\Temp\017a951c19ca633ac332f7737497434f.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2792 -
C:\ProgramData\jLbBnIiPmLe16645\jLbBnIiPmLe16645.exe"C:\ProgramData\jLbBnIiPmLe16645\jLbBnIiPmLe16645.exe" "C:\Users\Admin\AppData\Local\Temp\017a951c19ca633ac332f7737497434f.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Enumerates connected drives
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:1704
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
313KB
MD58c29802cd397ed0c95447e76185d5d44
SHA1bb23f1b7e02daf92fe964b3b8bc6a05100d8982f
SHA256e10b1a9b143dc9c8c8e2cde72d95bf88c306cbb82bc635937be777839c98b97b
SHA512a0aaa11dc9dd5455d478d5832c7d8dcd65bf30adf568cbca83b2d0195fe2aedd43ed5a9a08f06b8c9a8126057a9f8c38cd96c250730d6c8d6de8242278fa1713