Analysis
-
max time kernel
159s -
max time network
175s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
29/12/2023, 19:35
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
01e9007019c3b07fa881e53f9c400dfa.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
01e9007019c3b07fa881e53f9c400dfa.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
3 signatures
150 seconds
General
-
Target
01e9007019c3b07fa881e53f9c400dfa.exe
-
Size
30KB
-
MD5
01e9007019c3b07fa881e53f9c400dfa
-
SHA1
22d0438ba1fd0bc2af49f923ab5972be5e91db2d
-
SHA256
3c752ab3f1fba9dab9745d1e687b87a2c20471ac92c3e5644ec9522b77bf9c06
-
SHA512
532335c717224ac0dece26470189b9e6f58cea507c59060cb6358a0ac710d3381a3e8c18e63484fc06fbb29a2afa15d2f5ad0a376b5898a2bf442923b552cfca
-
SSDEEP
768:dzqdJWNqbx2dNanQmQqcyocxKWnbcuyD7UGNWGl:dMt2vanzxpHnouy8KP
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 01e9007019c3b07fa881e53f9c400dfa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 01e9007019c3b07fa881e53f9c400dfa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 01e9007019c3b07fa881e53f9c400dfa.exe -
Loads dropped DLL 1 IoCs
pid Process 2764 01e9007019c3b07fa881e53f9c400dfa.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\360se = "C:\\Users\\Admin\\AppData\\Local\\Temp\\01e9007019c3b07fa881e53f9c400dfa.exe" 01e9007019c3b07fa881e53f9c400dfa.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 01e9007019c3b07fa881e53f9c400dfa.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\h: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\k: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\n: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\q: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\m: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\t: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\v: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\y: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\g: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\l: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\p: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\u: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\x: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\i: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\j: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\o: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\r: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\s: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\w: 01e9007019c3b07fa881e53f9c400dfa.exe File opened (read-only) \??\z: 01e9007019c3b07fa881e53f9c400dfa.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\259450707.DLL 01e9007019c3b07fa881e53f9c400dfa.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\rgdltecq\nhoifz.pif 01e9007019c3b07fa881e53f9c400dfa.exe File opened for modification C:\Program Files (x86)\Common Files\rgdltecq\nhoifz.pif 01e9007019c3b07fa881e53f9c400dfa.exe -
Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe 2764 01e9007019c3b07fa881e53f9c400dfa.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2764 01e9007019c3b07fa881e53f9c400dfa.exe Token: SeDebugPrivilege 2764 01e9007019c3b07fa881e53f9c400dfa.exe -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 01e9007019c3b07fa881e53f9c400dfa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 01e9007019c3b07fa881e53f9c400dfa.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 01e9007019c3b07fa881e53f9c400dfa.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\01e9007019c3b07fa881e53f9c400dfa.exe"C:\Users\Admin\AppData\Local\Temp\01e9007019c3b07fa881e53f9c400dfa.exe"1⤵
- UAC bypass
- Loads dropped DLL
- Adds Run key to start application
- Checks whether UAC is enabled
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- System policy modification
PID:2764
Network
MITRE ATT&CK Enterprise v15
Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Defense Evasion
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Impair Defenses
1Disable or Modify Tools
1Modify Registry
3Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
12.1MB
MD57ef4a647078bd96818c2a264bc66d4a8
SHA160b041907cd60486637fe717cbbd00844f562426
SHA256f78daa9465612a2bea2de3cc009544f3e3a50dbdf35ccbac176005e85aef8299
SHA512961dd4cda512438212d89c2ce83f15f88a316d5cd45a2e0219aacfb330710f11061bcc7497734bc8b906267ab9c5dbad747e47383f1ba81210acee09d0bae00c