Analysis
-
max time kernel
148s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 00:43
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
221de6c71a03aa997a938b1a008f254e.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
221de6c71a03aa997a938b1a008f254e.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
221de6c71a03aa997a938b1a008f254e.exe
-
Size
32KB
-
MD5
221de6c71a03aa997a938b1a008f254e
-
SHA1
1af572e27ed9c212ba31c6109c136b0c34b17a6a
-
SHA256
5b015453d340d0a93a27cdfaf41888eff8d4b6fa810148e6f1c2d2833aca6fe0
-
SHA512
956439b83ec61e443f4f86380572965d0dc85d0621d01e1f36bb84211a76c12857258a6469555d67d70ab6106545e4f7656c0f42955290416476d59fd1379610
-
SSDEEP
768:++VNDgZL2OmF5ii+rtygy/9T3BGnbcuyD7UF3:ljskj+rrtyd9LBGnouy8p
Score
7/10
Malware Config
Signatures
-
Loads dropped DLL 1 IoCs
pid Process 2216 221de6c71a03aa997a938b1a008f254e.exe -
Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\k: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\p: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\s: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\t: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\y: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\e: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\h: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\l: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\m: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\n: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\q: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\v: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\w: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\x: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\z: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\g: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\i: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\j: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\o: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\r: 221de6c71a03aa997a938b1a008f254e.exe File opened (read-only) \??\u: 221de6c71a03aa997a938b1a008f254e.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\240608843.OCX 221de6c71a03aa997a938b1a008f254e.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\realteck\heoifz.pif 221de6c71a03aa997a938b1a008f254e.exe File opened for modification C:\Program Files (x86)\Common Files\realteck\heoifz.pif 221de6c71a03aa997a938b1a008f254e.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32 221de6c71a03aa997a938b1a008f254e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 221de6c71a03aa997a938b1a008f254e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 221de6c71a03aa997a938b1a008f254e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED} 221de6c71a03aa997a938b1a008f254e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\InProcServer32\ = "C:\\Windows\\SysWow64\\240608843.OCX" 221de6c71a03aa997a938b1a008f254e.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe 2216 221de6c71a03aa997a938b1a008f254e.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2216 221de6c71a03aa997a938b1a008f254e.exe Token: SeDebugPrivilege 2216 221de6c71a03aa997a938b1a008f254e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\221de6c71a03aa997a938b1a008f254e.exe"C:\Users\Admin\AppData\Local\Temp\221de6c71a03aa997a938b1a008f254e.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Program Files directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2216
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
58KB
MD5b845463ba0ad1c4ce2d7478adba0d3d4
SHA11f407413acc1401ed291edd1d5f08e081806df68
SHA25601cae233888496f450a3b3fafd7e0f43e03f97376e3db0930031f620edcc4f14
SHA512d1041d31b34a3f956572033f5f4b4b15fb83d09b97e8c81e13974e158d191ad110fe72d8b90fd500e743cd14354f8bcc8b367b9345f4d59d057862f892ba4be5