Analysis
-
max time kernel
170s -
max time network
216s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
31/12/2023, 04:34
Behavioral task
behavioral1
Sample
2859ff00b4d0ecbc0075a725d0217e7d.exe
Resource
win7-20231129-en
General
-
Target
2859ff00b4d0ecbc0075a725d0217e7d.exe
-
Size
70KB
-
MD5
2859ff00b4d0ecbc0075a725d0217e7d
-
SHA1
b5e9ae069aafd2645dd8bc0e631397f13fb89f7d
-
SHA256
71fdf0b969bb4532dd471fbd832913bba8d1be3ac16f178393bb111b4fdc152a
-
SHA512
3b4715f406fe684c30d0f00d0f52bf5e25cc4727598b37a63cccc21acc68e5bf02e8938b25ec67b794651f4fc97fd3e9fa011175ddf519389057c96127684ebc
-
SSDEEP
1536:Qc+E19oIzg3CJuL0gZEQ5w7x3kWM0erCdqeFPF4oEF6mQ81:RzjoIzg3Ci6uW3l8rCf781
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Executes dropped EXE 1 IoCs
pid Process 4032 msnmsgr.exe -
resource yara_rule behavioral2/memory/2264-0-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/2264-3-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/files/0x000b000000023127-9.dat upx behavioral2/memory/4032-11-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/4032-14-0x0000000000400000-0x0000000000422000-memory.dmp upx behavioral2/memory/2264-19-0x0000000000400000-0x0000000000422000-memory.dmp upx -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\msnmsgr.exe 2859ff00b4d0ecbc0075a725d0217e7d.exe File opened for modification C:\Windows\msnmsgr.exe 2859ff00b4d0ecbc0075a725d0217e7d.exe -
Runs .reg file with regedit 1 IoCs
pid Process 3936 regedit.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe 4032 msnmsgr.exe 4032 msnmsgr.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSystemtimePrivilege 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe Token: SeSystemtimePrivilege 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe Token: SeSystemtimePrivilege 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe Token: SeSystemtimePrivilege 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe 4032 msnmsgr.exe 4032 msnmsgr.exe 4032 msnmsgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2264 wrote to memory of 3936 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe 91 PID 2264 wrote to memory of 3936 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe 91 PID 2264 wrote to memory of 3936 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe 91 PID 2264 wrote to memory of 4032 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe 92 PID 2264 wrote to memory of 4032 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe 92 PID 2264 wrote to memory of 4032 2264 2859ff00b4d0ecbc0075a725d0217e7d.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\2859ff00b4d0ecbc0075a725d0217e7d.exe"C:\Users\Admin\AppData\Local\Temp\2859ff00b4d0ecbc0075a725d0217e7d.exe"1⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\regedit.exeregedit /s C:\1reg.reg2⤵
- Runs .reg file with regedit
PID:3936
-
-
C:\Windows\msnmsgr.exeC:\Windows\msnmsgr.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:4032
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
121B
MD58c0c2a3561f09e9da4f663ebd9db06dc
SHA1060cfdaa3aa592ec1bede0c4e71a6da3baf42dd4
SHA2564c3f8b2bae6bd3dec43219df3845068964d4a2e398bc20a32e75d7379d0a1c03
SHA512b45639591a3ad789831d6b45dd5e7e5cee5e8206f3fa225e39032e1f64d4dd3e74cd367444d615fa89259176e28cfeaa03106c87e12c45d4d5e4c9975b4a8ec8
-
Filesize
70KB
MD52859ff00b4d0ecbc0075a725d0217e7d
SHA1b5e9ae069aafd2645dd8bc0e631397f13fb89f7d
SHA25671fdf0b969bb4532dd471fbd832913bba8d1be3ac16f178393bb111b4fdc152a
SHA5123b4715f406fe684c30d0f00d0f52bf5e25cc4727598b37a63cccc21acc68e5bf02e8938b25ec67b794651f4fc97fd3e9fa011175ddf519389057c96127684ebc