eb069e038c957e564354e29041494ba33a63b6ce171b87585d1b714a7bdd2094

Analysis

max time kernel
121s
max time network
123s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
30/12/2023, 11:26

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

171dfc58c4bf72784a8db574c2df5539.exe
Size

22KB
MD5

171dfc58c4bf72784a8db574c2df5539
SHA1

19bdb77c53bed7ecb9d5c5cff274116cd97e8f08
SHA256

eb069e038c957e564354e29041494ba33a63b6ce171b87585d1b714a7bdd2094
SHA512

01bb89cd538a4a2fcb8099ddaabc99aa651eb7a0e3ff821415ff45a7e715258dac468a06dd4e1890af28a9c569868875cfb0fa885a8cd139ade32e4be6fdad1a
SSDEEP

384:ysfdaO4XrYC4wDgG/BXMBKlEyo7df854uC33qNT3qMbGgjYNLt1MVNvkJgZJJJAJ:jIfrYC4wDgyCuHsa5WELfjYtwHpJ/Acm

Score

7^/10

Malware Config

Signatures

Loads dropped DLL 1 IoCs

pid	Process
2932	171dfc58c4bf72784a8db574c2df5539.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\ddserh.dll.LoG	171dfc58c4bf72784a8db574c2df5539.exe
File created	C:\Windows\SysWOW64\ddserh.dll	171dfc58c4bf72784a8db574c2df5539.exe
File created	C:\Windows\SysWOW64\tf0	171dfc58c4bf72784a8db574c2df5539.exe

Modifies registry class 12 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A9895933-6636-4281-BC58-EE6DE2AF96E3}\InProcServer32\ = "C:\\Windows\\SysWow64\\ddserh.dll"	171dfc58c4bf72784a8db574c2df5539.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS	171dfc58c4bf72784a8db574c2df5539.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE	171dfc58c4bf72784a8db574c2df5539.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS	171dfc58c4bf72784a8db574c2df5539.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\SHELLEXECUTEHOOKS\	171dfc58c4bf72784a8db574c2df5539.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A9895933-6636-4281-BC58-EE6DE2AF96E3}\InProcServer32	171dfc58c4bf72784a8db574c2df5539.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A9895933-6636-4281-BC58-EE6DE2AF96E3}\ = "MICROSOFT"	171dfc58c4bf72784a8db574c2df5539.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A9895933-6636-4281-BC58-EE6DE2AF96E3}\InProcServer32\ThreadingModel = "Apartment"	171dfc58c4bf72784a8db574c2df5539.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT	171dfc58c4bf72784a8db574c2df5539.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION	171dfc58c4bf72784a8db574c2df5539.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER	171dfc58c4bf72784a8db574c2df5539.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{A9895933-6636-4281-BC58-EE6DE2AF96E3}	171dfc58c4bf72784a8db574c2df5539.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2932	171dfc58c4bf72784a8db574c2df5539.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeBackupPrivilege	2932	171dfc58c4bf72784a8db574c2df5539.exe
Token: SeRestorePrivilege	2932	171dfc58c4bf72784a8db574c2df5539.exe
Token: SeBackupPrivilege	2932	171dfc58c4bf72784a8db574c2df5539.exe
Token: SeRestorePrivilege	2932	171dfc58c4bf72784a8db574c2df5539.exe

Suspicious use of SetWindowsHookEx 3 IoCs

pid	Process
2932	171dfc58c4bf72784a8db574c2df5539.exe
2932	171dfc58c4bf72784a8db574c2df5539.exe
2932	171dfc58c4bf72784a8db574c2df5539.exe

C:\Users\Admin\AppData\Local\Temp\171dfc58c4bf72784a8db574c2df5539.exe
"C:\Users\Admin\AppData\Local\Temp\171dfc58c4bf72784a8db574c2df5539.exe"
1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2932

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2932-2-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download
memory/2932-5-0x0000000000260000-0x000000000026E000-memory.dmp

Filesize
56KB

Download