83b5efe38cc3f8881a96fbb114f18fece3f9f3e74806fb48b1610bb90b6b452c

Analysis

max time kernel
122s
max time network
126s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 07:06

Target

11b856128f5282fb991b02f3ac007ade.exe
Size

68KB
MD5

11b856128f5282fb991b02f3ac007ade
SHA1

fa2d35b939402c591a2e3fe6ab9cb21bf1a845aa
SHA256

83b5efe38cc3f8881a96fbb114f18fece3f9f3e74806fb48b1610bb90b6b452c
SHA512

e6460efbe7cea2c76e51ce3e74da347fa0076eede5971798771a9de34d0b136bd4f1900c6ee2de42db8eeca1add5d93670e35da736425d97a7a4f5f80e02ce48
SSDEEP

768:ITDDn3f3KK58yH8NiZtFlzbIMaJycQWp48V5wh9XnUn585JTvjfOR:ITPvKE8m8gPoqWpNTwh9XnA8517fOR

Score

7^/10

Deletes itself 1 IoCs

pid	Process
2720	cmd.exe

Loads dropped DLL 1 IoCs

pid	Process
1080	11b856128f5282fb991b02f3ac007ade.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\midaeghDrv.dll	11b856128f5282fb991b02f3ac007ade.exe
File created	C:\Windows\SysWOW64\midaeghDrv.dll	11b856128f5282fb991b02f3ac007ade.exe

Modifies registry class 8 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6ECB0BE8-933C-91D2-C901-9A11EA15121A}\InProcServer32\ThreadingModel = "Apartment"	11b856128f5282fb991b02f3ac007ade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\\{6ECB0BE8-933C-91D2-C901-9A11EA15121A}\InProcServer32	11b856128f5282fb991b02f3ac007ade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node	11b856128f5282fb991b02f3ac007ade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID	11b856128f5282fb991b02f3ac007ade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\	11b856128f5282fb991b02f3ac007ade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6ECB0BE8-933C-91D2-C901-9A11EA15121A}	11b856128f5282fb991b02f3ac007ade.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6ECB0BE8-933C-91D2-C901-9A11EA15121A}\InProcServer32	11b856128f5282fb991b02f3ac007ade.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{6ECB0BE8-933C-91D2-C901-9A11EA15121A}\InProcServer32\ = "C:\\Windows\\SysWow64\\midaeghDrv.dll"	11b856128f5282fb991b02f3ac007ade.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeSystemtimePrivilege	1080	11b856128f5282fb991b02f3ac007ade.exe
Token: SeSystemtimePrivilege	1080	11b856128f5282fb991b02f3ac007ade.exe
Token: SeSystemtimePrivilege	1080	11b856128f5282fb991b02f3ac007ade.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1080	11b856128f5282fb991b02f3ac007ade.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1080 wrote to memory of 2720	1080	11b856128f5282fb991b02f3ac007ade.exe	28
PID 1080 wrote to memory of 2720	1080	11b856128f5282fb991b02f3ac007ade.exe	28
PID 1080 wrote to memory of 2720	1080	11b856128f5282fb991b02f3ac007ade.exe	28
PID 1080 wrote to memory of 2720	1080	11b856128f5282fb991b02f3ac007ade.exe	28

C:\Users\Admin\AppData\Local\Temp\11b856128f5282fb991b02f3ac007ade.exe
"C:\Users\Admin\AppData\Local\Temp\11b856128f5282fb991b02f3ac007ade.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1080
- C:\Windows\SysWOW64\cmd.exe
  cmd /c cas.bat
  2⤵
  - Deletes itself
  PID:2720

C:\Users\Admin\AppData\Local\Temp\cas.bat

Filesize
190B

MD5
1a1364796fc1961375a359bfba770802

SHA1
df502e9dfbca5ae59cddbcd44ea2439168eb2248

SHA256
47375aff4623478dadaff1d72ca0960516d6d15f38e6f1da9c21c03467f6d406

SHA512
ce0045b4d83b6cc65ab4432d29f5d9607658a73780e631db1fabfcb7a4a47362615329a6302ec2041bcdaeb53140e793a2c7b31b772fb2f547d29da58b43f36c

Download Submit
\Windows\SysWOW64\midaeghDrv.dll

Filesize
44KB

MD5
3107cc9af676b231567378f5d7ba329d

SHA1
4443a747b70e353772419fcdf8587cc06c6bdec8

SHA256
07d0e7ea82b1395a5f8101392b0ca26e46e9b91592c29c13806cffdf55b63118

SHA512
82bf1f04a77e1fa2155b4d0586ea252fa775207aaac1bf679c44db2482d524841af979ab4ea18d1582157a42f159af78859bdaca9dc5e7232aa9e80731cb919b

Download Submit