Analysis
-
max time kernel
149s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
30/12/2023, 22:01
Static task
static1
Behavioral task
behavioral1
Sample
1de1cece94d95a6b74b13a8d0a204ee8.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
1de1cece94d95a6b74b13a8d0a204ee8.exe
Resource
win10v2004-20231222-en
General
-
Target
1de1cece94d95a6b74b13a8d0a204ee8.exe
-
Size
122KB
-
MD5
1de1cece94d95a6b74b13a8d0a204ee8
-
SHA1
64b6b2801be37a6ab2e22bac2994f63696a15de1
-
SHA256
4351a80a48383ae440d4c53eb347e742f32bd40e675e7b5c31c675e20778819e
-
SHA512
5718996d3dd4f089f955dbbdf8437ea61a7f03cdeb002865bbc0da284217396bac2318f6cece9500c32964be41105806ff5ccd0cc1ba1886eb94537bb1ba936e
-
SSDEEP
3072:a8KfDP6rX2Gsttc0pL6R830bGoHt98G4EuEQYglj5:aBDP6rmGstD16RAojuEPOlj5
Malware Config
Signatures
-
Sets DLL path for service in the registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wind0ws\Parameters\ServiceDll = "C:\\Program Files\\Windows Media Player\\wupdmgr32.dll" 1de1cece94d95a6b74b13a8d0a204ee8.exe -
Deletes itself 1 IoCs
pid Process 2828 svchost.exe -
Loads dropped DLL 1 IoCs
pid Process 2828 svchost.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File opened for modification C:\Program Files\Windows Media Player 1de1cece94d95a6b74b13a8d0a204ee8.exe File created C:\Program Files\Windows Media Player\wupdmgr32.dll 1de1cece94d95a6b74b13a8d0a204ee8.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\ThankU.txt 1de1cece94d95a6b74b13a8d0a204ee8.exe -
Kills process with taskkill 1 IoCs
pid Process 2548 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2532 1de1cece94d95a6b74b13a8d0a204ee8.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2828 svchost.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 2548 taskkill.exe Token: SeBackupPrivilege 2532 1de1cece94d95a6b74b13a8d0a204ee8.exe Token: SeRestorePrivilege 2532 1de1cece94d95a6b74b13a8d0a204ee8.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2532 wrote to memory of 2548 2532 1de1cece94d95a6b74b13a8d0a204ee8.exe 28 PID 2532 wrote to memory of 2548 2532 1de1cece94d95a6b74b13a8d0a204ee8.exe 28 PID 2532 wrote to memory of 2548 2532 1de1cece94d95a6b74b13a8d0a204ee8.exe 28 PID 2532 wrote to memory of 2548 2532 1de1cece94d95a6b74b13a8d0a204ee8.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1de1cece94d95a6b74b13a8d0a204ee8.exe"C:\Users\Admin\AppData\Local\Temp\1de1cece94d95a6b74b13a8d0a204ee8.exe"1⤵
- Sets DLL path for service in the registry
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2532 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /t /im KSafeTray.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\SysWOW64\svchost.exe -k netsvcs1⤵
- Deletes itself
- Loads dropped DLL
- Suspicious behavior: GetForegroundWindowSpam
PID:2828
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
109KB
MD5545aa0ee83fdceda04e3f13d9115c1b9
SHA1ba0d92d2e2ad808b329879bfcae145e6ade8bbf0
SHA2568343d5fc3485323ea04e4022687f50108c6b1c02858aff4b83eac1516c401884
SHA5122294e0da8f55d64c242024af4ebf3e0f92a17a95f98f6314cc9defae189c1e689a54cb7f7c1f02e6511a78499894bf386b920c556a8bb9ba5156febb7e929432