a22f393576c3c8fa3ade88102fa98dfc93097d15b4c453ef676f6daaefffa592

Analysis

max time kernel
117s
max time network
119s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
26/12/2023, 03:51

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

AutoSettings/Enable_Sensors.bat
Size

5KB
MD5

e7af5b1aa32ba337b911509a294ce959
SHA1

6a84fd55c440fe35f2cc71fdca5a7818c80d9127
SHA256

e16d47f43aa3334de3bcf1c3a6234fef05135ca1102f00eda7b714dc651470f1
SHA512

91e712a1f3bdd1c7d58e6b7532877848159c5fb128b1ea24da470ee58489d9a941fa835a8dd863741856046fefa1f401c60e42bba09f6a2ce882bc24b957e172
SSDEEP

96:fgexK+/VNhXhHsG2Wk0kdKarsUBiTkit5JHiRYkXoNRm/V:IkVNfXhHsG2Wk0mKarsUApJCRANRm/V

Score

7^/10

upx

Malware Config

Signatures

UPX packed file 11 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral7/memory/3000-7-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral7/memory/2712-24-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral7/memory/2840-23-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral7/memory/2636-11-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral7/memory/2244-10-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral7/memory/1252-9-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral7/memory/3012-8-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral7/memory/2944-5-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral7/memory/2192-3-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral7/memory/2936-1-0x0000000000400000-0x0000000000416000-memory.dmp	upx
behavioral7/memory/2904-0-0x0000000000400000-0x0000000000416000-memory.dmp	upx

Drops file in System32 directory 5 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\GroupPolicy	LGPO.exe
File opened for modification	C:\Windows\SysWOW64\GroupPolicy\gpt.ini	LGPO.exe
File created	C:\Windows\System32\GroupPolicy\Machine\Registry.pol	LGPO.exe
File opened for modification	C:\Windows\System32\GroupPolicy\GPT.INI	LGPO.exe
File created	C:\Windows\System32\GroupPolicy\User\Registry.pol	LGPO.exe

Launches sc.exe 3 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
2584	sc.exe
2956	sc.exe
3064	sc.exe

Suspicious behavior: CmdExeWriteProcessMemorySpam 12 IoCs

pid	Process
2904	cecho.exe
2936	cecho.exe
2192	cecho.exe
2944	cecho.exe
3000	cecho.exe
3012	cecho.exe
1252	cecho.exe
2244	cecho.exe
2636	cecho.exe
2648	LGPO.exe
2840	cecho.exe
2712	cecho.exe

Suspicious use of WriteProcessMemory 63 IoCs

description	pid	Process	procid_target
PID 2968 wrote to memory of 2880	2968	cmd.exe	32
PID 2968 wrote to memory of 2880	2968	cmd.exe	32
PID 2968 wrote to memory of 2880	2968	cmd.exe	32
PID 2968 wrote to memory of 2888	2968	cmd.exe	31
PID 2968 wrote to memory of 2888	2968	cmd.exe	31
PID 2968 wrote to memory of 2888	2968	cmd.exe	31
PID 2968 wrote to memory of 2904	2968	cmd.exe	30
PID 2968 wrote to memory of 2904	2968	cmd.exe	30
PID 2968 wrote to memory of 2904	2968	cmd.exe	30
PID 2968 wrote to memory of 2904	2968	cmd.exe	30
PID 2968 wrote to memory of 2936	2968	cmd.exe	29
PID 2968 wrote to memory of 2936	2968	cmd.exe	29
PID 2968 wrote to memory of 2936	2968	cmd.exe	29
PID 2968 wrote to memory of 2936	2968	cmd.exe	29
PID 2968 wrote to memory of 2192	2968	cmd.exe	28
PID 2968 wrote to memory of 2192	2968	cmd.exe	28
PID 2968 wrote to memory of 2192	2968	cmd.exe	28
PID 2968 wrote to memory of 2192	2968	cmd.exe	28
PID 2968 wrote to memory of 2944	2968	cmd.exe	27
PID 2968 wrote to memory of 2944	2968	cmd.exe	27
PID 2968 wrote to memory of 2944	2968	cmd.exe	27
PID 2968 wrote to memory of 2944	2968	cmd.exe	27
PID 2968 wrote to memory of 3000	2968	cmd.exe	26
PID 2968 wrote to memory of 3000	2968	cmd.exe	26
PID 2968 wrote to memory of 3000	2968	cmd.exe	26
PID 2968 wrote to memory of 3000	2968	cmd.exe	26
PID 2968 wrote to memory of 3012	2968	cmd.exe	25
PID 2968 wrote to memory of 3012	2968	cmd.exe	25
PID 2968 wrote to memory of 3012	2968	cmd.exe	25
PID 2968 wrote to memory of 3012	2968	cmd.exe	25
PID 2968 wrote to memory of 3064	2968	cmd.exe	24
PID 2968 wrote to memory of 3064	2968	cmd.exe	24
PID 2968 wrote to memory of 3064	2968	cmd.exe	24
PID 2968 wrote to memory of 1252	2968	cmd.exe	23
PID 2968 wrote to memory of 1252	2968	cmd.exe	23
PID 2968 wrote to memory of 1252	2968	cmd.exe	23
PID 2968 wrote to memory of 1252	2968	cmd.exe	23
PID 2968 wrote to memory of 2956	2968	cmd.exe	22
PID 2968 wrote to memory of 2956	2968	cmd.exe	22
PID 2968 wrote to memory of 2956	2968	cmd.exe	22
PID 2968 wrote to memory of 2244	2968	cmd.exe	21
PID 2968 wrote to memory of 2244	2968	cmd.exe	21
PID 2968 wrote to memory of 2244	2968	cmd.exe	21
PID 2968 wrote to memory of 2244	2968	cmd.exe	21
PID 2968 wrote to memory of 2584	2968	cmd.exe	20
PID 2968 wrote to memory of 2584	2968	cmd.exe	20
PID 2968 wrote to memory of 2584	2968	cmd.exe	20
PID 2968 wrote to memory of 2636	2968	cmd.exe	19
PID 2968 wrote to memory of 2636	2968	cmd.exe	19
PID 2968 wrote to memory of 2636	2968	cmd.exe	19
PID 2968 wrote to memory of 2636	2968	cmd.exe	19
PID 2968 wrote to memory of 2648	2968	cmd.exe	16
PID 2968 wrote to memory of 2648	2968	cmd.exe	16
PID 2968 wrote to memory of 2648	2968	cmd.exe	16
PID 2968 wrote to memory of 2648	2968	cmd.exe	16
PID 2968 wrote to memory of 2840	2968	cmd.exe	18
PID 2968 wrote to memory of 2840	2968	cmd.exe	18
PID 2968 wrote to memory of 2840	2968	cmd.exe	18
PID 2968 wrote to memory of 2840	2968	cmd.exe	18
PID 2968 wrote to memory of 2712	2968	cmd.exe	17
PID 2968 wrote to memory of 2712	2968	cmd.exe	17
PID 2968 wrote to memory of 2712	2968	cmd.exe	17
PID 2968 wrote to memory of 2712	2968	cmd.exe	17

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\LGPO.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\LGPO.exe" /t "C:\Users\Admin\AppData\Local\Temp\LGPO-file.txt" /q
1⤵
- Drops file in System32 directory
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2648

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0a}Перезагрузите компьютер!!! {\n #}
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2712

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0a}Исправление выполнено {\n #}
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2840

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0b}Применение параметров из LGPO файла {08}(настройка ГП) {\n #}
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2636

C:\Windows\system32\sc.exe
sc config SensorDataService start= demand
1⤵
- Launches sc.exe
PID:2584

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0f}Служба "Служба данных датчиков"{\n #}
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2244

C:\Windows\system32\sc.exe
sc config SensorService start= demand
1⤵
- Launches sc.exe
PID:2956

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0f}"Служба датчиков" (датчики поворота дисплея, местоположения и т.д.){\n #}
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:1252

C:\Windows\system32\sc.exe
sc config SensrSvc start= demand
1⤵
- Launches sc.exe
PID:3064

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0f}Служба наблюдения за датчиками "SensrSvc" (кооректировка яркости дисплея, поворота экрана и т.д.){\n #}
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:3012

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0a}Добавлен параметр в LGPO файл {08}(для настройки ГП){#}:{\n #}
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:3000

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0a}Добавлен параметр в LGPO файл {08}(для настройки ГП){#}:{\n #}
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2944

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0a}Добавлен параметр в LGPO файл {08}(для настройки ГП){#}:{\n #}
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2192

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0f}"Включение определения вашего расположения для AppStore и Других программ (Геозона)" {0b}Настроить ГП!{\n #}
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2936

C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe
"C:\Users\Admin\AppData\Local\Temp\AUTOSE~1\Files\Tools\cecho.exe" {0b}Добавление настройки Групповой Политики в файл LGPO:{\n #}
1⤵
- Suspicious behavior: CmdExeWriteProcessMemorySpam
PID:2904

C:\Windows\system32\reg.exe
reg query "HKU\S-1-5-19\Environment"
1⤵
PID:2888

C:\Windows\system32\chcp.com
chcp 65001
1⤵
PID:2880

C:\Windows\system32\cmd.exe
cmd /c "C:\Users\Admin\AppData\Local\Temp\AutoSettings\Enable_Sensors.bat"
1⤵
- Suspicious use of WriteProcessMemory
PID:2968

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1252-9-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2192-3-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2244-10-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2636-11-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2712-24-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2840-23-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2904-0-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2936-1-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/2944-5-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3000-7-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download
memory/3012-8-0x0000000000400000-0x0000000000416000-memory.dmp

Filesize
88KB

Download