Analysis
-
max time kernel
149s -
max time network
125s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 23:15
Static task
static1
Behavioral task
behavioral1
Sample
429ac1a806b4fcdc9bf44ea6987f94f6.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
429ac1a806b4fcdc9bf44ea6987f94f6.exe
Resource
win10v2004-20231215-en
General
-
Target
429ac1a806b4fcdc9bf44ea6987f94f6.exe
-
Size
123KB
-
MD5
429ac1a806b4fcdc9bf44ea6987f94f6
-
SHA1
8e4bb6295d40c6f19aab7c47cca3d945747d41e4
-
SHA256
24e6a700c2676fa3c1979958e16c0fa8dbd9fb818dba822cdf7ce001c1a68043
-
SHA512
50dbab8769fc80ec291d338390dc3d6ea080ebd969a7cac47d23afcce4f9183b6ffbc0d5ad4a35191ea6300c60d501515f574feee47741c70bd09acce72685b4
-
SSDEEP
3072:Lf3nTY/Afey9FpatoPnprvFFE3sHX2qawogX48:rT68ey9utonprOe2q
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
Processes:
svchost.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\Netscape = "C:\\Users\\Admin\\AppData\\Roaming\\88C531.exe" svchost.exe -
Executes dropped EXE 2 IoCs
Processes:
ZHxWx.execvtres.exepid process 2440 ZHxWx.exe 2788 cvtres.exe -
Loads dropped DLL 3 IoCs
Processes:
429ac1a806b4fcdc9bf44ea6987f94f6.exeZHxWx.exepid process 2132 429ac1a806b4fcdc9bf44ea6987f94f6.exe 2132 429ac1a806b4fcdc9bf44ea6987f94f6.exe 2440 ZHxWx.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
Processes:
cvtres.exedescription ioc process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum cvtres.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 cvtres.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ZHxWx.exedescription pid process target process PID 2440 set thread context of 2788 2440 ZHxWx.exe cvtres.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
ZHxWx.exepid process 2440 ZHxWx.exe 2440 ZHxWx.exe -
Suspicious behavior: MapViewOfSection 2 IoCs
Processes:
cvtres.exepid process 2788 cvtres.exe 2788 cvtres.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ZHxWx.exedescription pid process Token: SeDebugPrivilege 2440 ZHxWx.exe -
Suspicious use of WriteProcessMemory 15 IoCs
Processes:
429ac1a806b4fcdc9bf44ea6987f94f6.exeZHxWx.execvtres.exedescription pid process target process PID 2132 wrote to memory of 2440 2132 429ac1a806b4fcdc9bf44ea6987f94f6.exe ZHxWx.exe PID 2132 wrote to memory of 2440 2132 429ac1a806b4fcdc9bf44ea6987f94f6.exe ZHxWx.exe PID 2132 wrote to memory of 2440 2132 429ac1a806b4fcdc9bf44ea6987f94f6.exe ZHxWx.exe PID 2132 wrote to memory of 2440 2132 429ac1a806b4fcdc9bf44ea6987f94f6.exe ZHxWx.exe PID 2440 wrote to memory of 2788 2440 ZHxWx.exe cvtres.exe PID 2440 wrote to memory of 2788 2440 ZHxWx.exe cvtres.exe PID 2440 wrote to memory of 2788 2440 ZHxWx.exe cvtres.exe PID 2440 wrote to memory of 2788 2440 ZHxWx.exe cvtres.exe PID 2440 wrote to memory of 2788 2440 ZHxWx.exe cvtres.exe PID 2440 wrote to memory of 2788 2440 ZHxWx.exe cvtres.exe PID 2440 wrote to memory of 2788 2440 ZHxWx.exe cvtres.exe PID 2788 wrote to memory of 2704 2788 cvtres.exe svchost.exe PID 2788 wrote to memory of 2704 2788 cvtres.exe svchost.exe PID 2788 wrote to memory of 2704 2788 cvtres.exe svchost.exe PID 2788 wrote to memory of 2704 2788 cvtres.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cvtres.exeC:\Users\Admin\AppData\Local\Temp\\cvtres.exe1⤵
- Executes dropped EXE
- Maps connected drives based on registry
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Adds policy Run key to start application
-
C:\Users\Admin\AppData\Local\Temp\ZHxWx.exe"C:\Users\Admin\AppData\Local\Temp\ZHxWx.exe"1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\429ac1a806b4fcdc9bf44ea6987f94f6.exe"C:\Users\Admin\AppData\Local\Temp\429ac1a806b4fcdc9bf44ea6987f94f6.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\ZHxWx.exeFilesize
77KB
MD52b0653fd5eca2b3b2c62a11beb3529f1
SHA197ded9593b80038976ef9f4f5360ec173476508d
SHA25635b8cea3645e9478855787160752e5feb62156d5780213db82fe96a17a7534e5
SHA512cdba35b21c95eaacefe770ee7537a07d4893e39a34ee594f367363d774eed1c9b2ddd834459934d81f93c763eea57ec9df084ea2bfa978c17c5b5e2ab42bb5e2
-
\Users\Admin\AppData\Local\Temp\cvtres.exeFilesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2
-
memory/2132-13-0x0000000074DE0000-0x000000007538B000-memory.dmpFilesize
5.7MB
-
memory/2132-2-0x0000000000C40000-0x0000000000C80000-memory.dmpFilesize
256KB
-
memory/2132-1-0x0000000074DE0000-0x000000007538B000-memory.dmpFilesize
5.7MB
-
memory/2132-0-0x0000000074DE0000-0x000000007538B000-memory.dmpFilesize
5.7MB
-
memory/2440-30-0x0000000074DE0000-0x000000007538B000-memory.dmpFilesize
5.7MB
-
memory/2440-14-0x00000000004F0000-0x0000000000530000-memory.dmpFilesize
256KB
-
memory/2440-21-0x0000000074DE0000-0x000000007538B000-memory.dmpFilesize
5.7MB
-
memory/2440-15-0x0000000074DE0000-0x000000007538B000-memory.dmpFilesize
5.7MB
-
memory/2704-33-0x0000000000F00000-0x0000000000F08000-memory.dmpFilesize
32KB
-
memory/2704-35-0x0000000000F00000-0x0000000000F08000-memory.dmpFilesize
32KB
-
memory/2704-36-0x00000000000C0000-0x00000000000C4000-memory.dmpFilesize
16KB
-
memory/2704-43-0x0000000000030000-0x000000000003C000-memory.dmpFilesize
48KB
-
memory/2704-37-0x0000000000030000-0x000000000003C000-memory.dmpFilesize
48KB
-
memory/2704-42-0x0000000000030000-0x000000000003C000-memory.dmpFilesize
48KB
-
memory/2704-46-0x0000000000030000-0x000000000003C000-memory.dmpFilesize
48KB
-
memory/2788-27-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/2788-29-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/2788-23-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/2788-25-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/2788-20-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/2788-32-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB