Analysis
-
max time kernel
147s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
25-12-2023 06:04
Static task
static1
Behavioral task
behavioral1
Sample
0a37ecfea5074fff2de431e643e74af0.exe
Resource
win7-20231129-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0a37ecfea5074fff2de431e643e74af0.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
0a37ecfea5074fff2de431e643e74af0.exe
-
Size
693KB
-
MD5
0a37ecfea5074fff2de431e643e74af0
-
SHA1
4ff3dfa39ae7fd46772c30ff547ed935e134396f
-
SHA256
114ad38ef50939dbc71a24923dff65aad0167b7679805d3c3a5a2fd4b6925247
-
SHA512
7ee5854e7e3cebf76de910b47f427095c420cd27c227d74cd0c62e44f2adfc429c1abb02391cc7ca15df28a99ce471c4912d4a41fc43e234d78029f330f3c33f
-
SSDEEP
12288:tSIzbMSwyUI2buNNqwfVsQV2wWU4dh2hPnmrTVr5i38VeUbBxjv:tSibMSws2SqwGuZUgz3kXjv
Score
10/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 2632 0a37ecfea5074fff2de431e643e74af0.exe -
Loads dropped DLL 1 IoCs
pid Process 2824 0a37ecfea5074fff2de431e643e74af0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\Sample.lnk" 0a37ecfea5074fff2de431e643e74af0.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2824 set thread context of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2824 0a37ecfea5074fff2de431e643e74af0.exe 2824 0a37ecfea5074fff2de431e643e74af0.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2632 0a37ecfea5074fff2de431e643e74af0.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2824 0a37ecfea5074fff2de431e643e74af0.exe Token: SeDebugPrivilege 2632 0a37ecfea5074fff2de431e643e74af0.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2612 DllHost.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2632 0a37ecfea5074fff2de431e643e74af0.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 2824 wrote to memory of 2036 2824 0a37ecfea5074fff2de431e643e74af0.exe 28 PID 2824 wrote to memory of 2036 2824 0a37ecfea5074fff2de431e643e74af0.exe 28 PID 2824 wrote to memory of 2036 2824 0a37ecfea5074fff2de431e643e74af0.exe 28 PID 2824 wrote to memory of 2036 2824 0a37ecfea5074fff2de431e643e74af0.exe 28 PID 2824 wrote to memory of 2248 2824 0a37ecfea5074fff2de431e643e74af0.exe 30 PID 2824 wrote to memory of 2248 2824 0a37ecfea5074fff2de431e643e74af0.exe 30 PID 2824 wrote to memory of 2248 2824 0a37ecfea5074fff2de431e643e74af0.exe 30 PID 2824 wrote to memory of 2248 2824 0a37ecfea5074fff2de431e643e74af0.exe 30 PID 2824 wrote to memory of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33 PID 2824 wrote to memory of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33 PID 2824 wrote to memory of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33 PID 2824 wrote to memory of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33 PID 2824 wrote to memory of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33 PID 2824 wrote to memory of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33 PID 2824 wrote to memory of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33 PID 2824 wrote to memory of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33 PID 2824 wrote to memory of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33 PID 2824 wrote to memory of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33 PID 2824 wrote to memory of 2632 2824 0a37ecfea5074fff2de431e643e74af0.exe 33
Processes
-
C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0.exe"C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵PID:2036
-
-
C:\Windows\SysWOW64\CMD.exe"CMD"2⤵PID:2248
-
-
C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0.exe"C:\Users\Admin\AppData\Local\Temp\0a37ecfea5074fff2de431e643e74af0.exe"2⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2632
-
-
C:\Windows\SysWOW64\DllHost.exeC:\Windows\SysWOW64\DllHost.exe /Processid:{76D0CB12-7604-4048-B83C-1005C7DDC503}1⤵
- Suspicious use of FindShellTrayWindow
PID:2612