Analysis
-
max time kernel
4s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25/12/2023, 01:06
Behavioral task
behavioral1
Sample
1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe
Resource
win7-20231215-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe
-
Size
145KB
-
MD5
1f313f8a0fb1d37f3d7d0b53a6e5bd70
-
SHA1
64c89ea4b19bdc85f5f0c9b49430635c7a077d0a
-
SHA256
34f86c5d8ad41ae37d6e843f884a8261ad2c55534f5635ddf368f65323b3dbcf
-
SHA512
db0a50953b83b88f1594096ce7cad35d6bde8a562708eb016cae091eb931af614dcd9d363618223bbeadb1c929ccdf10733470502d38516fdcc1f6292e61546e
-
SSDEEP
384:beRq2+Te7vMw5Qm/w96XsIDnN7oE8INlRe0h9kVWJVXiM2+3iY:KRKyMw5QKXsYcYlhbWWJIsi
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe," 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Drops file in Drivers directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\drivers\spools.exe 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File created C:\Windows\SysWOW64\drivers\spools.exe 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
ACProtect 1.3x - 1.4x DLL software 2 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/memory/1212-13-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral1/memory/1212-14-0x0000000010000000-0x000000001010B000-memory.dmp acprotect -
Loads dropped DLL 1 IoCs
pid Process 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
resource yara_rule behavioral1/memory/1212-0-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1212-13-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral1/memory/1212-15-0x0000000000400000-0x0000000000426000-memory.dmp upx behavioral1/memory/1212-14-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral1/memory/2832-17-0x0000000000400000-0x0000000000426000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Enumerates connected drives 3 TTPs 64 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\O: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\U: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\R: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\S: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\W: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\I: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\K: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\I: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\V: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\U: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\O: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\S: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\Q: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\H: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\I: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\P: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\R: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\L: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\X: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\P: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\E: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\O: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\W: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\T: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\V: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\K: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\G: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\W: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\K: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\S: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\Q: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\T: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\N: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\G: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\L: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\U: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\Q: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\U: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\P: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\J: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\N: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\E: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\N: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\P: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\Q: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\R: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\J: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\J: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\E: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\X: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\X: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\I: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\L: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\V: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\T: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\G: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\H: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\N: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\H: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\W: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\O: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\E: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\M: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe File opened (read-only) \??\H: 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Installs/modifies Browser Helper Object 2 TTPs 4 IoCs
BHOs are DLL modules which act as plugins for Internet Explorer.
description ioc Process Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{B4F3A835-0E21-4959-BA22-42B3008E02FF} reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects reg.exe Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3} reg.exe -
Modifies WinLogon 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\UIHost = "logonui.exe" 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftpdll.dll 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Suspicious behavior: EnumeratesProcesses 54 IoCs
pid Process 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2832 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2056 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2832 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2056 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2832 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2756 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2056 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2832 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2756 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2056 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2832 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 2756 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 1212 wrote to memory of 2832 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 30 PID 1212 wrote to memory of 2832 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 30 PID 1212 wrote to memory of 2832 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 30 PID 1212 wrote to memory of 2832 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 30 PID 1212 wrote to memory of 2056 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 32 PID 1212 wrote to memory of 2056 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 32 PID 1212 wrote to memory of 2056 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 32 PID 1212 wrote to memory of 2056 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 32 PID 2832 wrote to memory of 2756 2832 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 34 PID 2832 wrote to memory of 2756 2832 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 34 PID 2832 wrote to memory of 2756 2832 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 34 PID 2832 wrote to memory of 2756 2832 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 34 PID 1212 wrote to memory of 2800 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 35 PID 1212 wrote to memory of 2800 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 35 PID 1212 wrote to memory of 2800 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 35 PID 1212 wrote to memory of 2800 1212 1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe"C:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe"1⤵
- Modifies WinLogon for persistence
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Modifies WinLogon
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1212 -
C:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exeC:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2832 -
C:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exeC:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe3⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:2756
-
-
-
C:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exeC:\Users\Admin\AppData\Local\Temp\1f313f8a0fb1d37f3d7d0b53a6e5bd70.exe2⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
PID:2056
-
-
C:\Windows\SysWOW64\reg.exereg delete "HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects" /f2⤵
- Installs/modifies Browser Helper Object
PID:2800
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2Browser Extensions
1Privilege Escalation
Boot or Logon Autostart Execution
4Registry Run Keys / Startup Folder
2Winlogon Helper DLL
2