0710387a53ee2d45241f35f962168a5317469cd80244c85084f4bfe991495856

Analysis

max time kernel
117s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
31-12-2023 04:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

28028a7cd9a23bde1b0029e6148af986.exe
Size

180KB
MD5

28028a7cd9a23bde1b0029e6148af986
SHA1

4a080ad3b399024615f229357847e079c6597af8
SHA256

0710387a53ee2d45241f35f962168a5317469cd80244c85084f4bfe991495856
SHA512

0dc87a51682e4dbceff5006574bab8c75eebd818af7c3599ef628717af7d02cbcd6b82268f15694544fa4725d54a25e5ce952867b292c62d5b2e2030838fa5ee
SSDEEP

3072:F0cdgtALiLfa9o1mytjPGttGYmFbJ5Cc9bBBe9:KOgtBt1h+ttGYWfbu9

Score

10^/10

persistence upx

Malware Config

Signatures

Modifies WinLogon for persistence 2 TTPs 1 IoCs

persistence

Winlogon Helper DLL

T1547.004

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe"	28028a7cd9a23bde1b0029e6148af986.exe

Deletes itself 1 IoCs

pid	Process
2940	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2056	fgspejs.exe

Loads dropped DLL 2 IoCs

pid	Process
3048	28028a7cd9a23bde1b0029e6148af986.exe
3048	28028a7cd9a23bde1b0029e6148af986.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/files/0x0012000000016cf7-21.dat	upx
behavioral1/memory/3048-28-0x0000000000260000-0x0000000000277000-memory.dmp	upx
behavioral1/memory/2056-31-0x0000000000400000-0x0000000000417000-memory.dmp	upx

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSConfig = "C:\\Users\\Admin\\fgspejs.exe \\u"	28028a7cd9a23bde1b0029e6148af986.exe

Drops file in System32 directory 3 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\userdiff.sav	28028a7cd9a23bde1b0029e6148af986.exe
File created	C:\Windows\SysWOW64\userdiff.sav	28028a7cd9a23bde1b0029e6148af986.exe
File opened for modification	C:\Windows\SysWOW64\userdiff.sav	fgspejs.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 3000 set thread context of 3048	3000	28028a7cd9a23bde1b0029e6148af986.exe	28
PID 2056 set thread context of 2896	2056	fgspejs.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3000 wrote to memory of 3048	3000	28028a7cd9a23bde1b0029e6148af986.exe	28
PID 3000 wrote to memory of 3048	3000	28028a7cd9a23bde1b0029e6148af986.exe	28
PID 3000 wrote to memory of 3048	3000	28028a7cd9a23bde1b0029e6148af986.exe	28
PID 3000 wrote to memory of 3048	3000	28028a7cd9a23bde1b0029e6148af986.exe	28
PID 3000 wrote to memory of 3048	3000	28028a7cd9a23bde1b0029e6148af986.exe	28
PID 3000 wrote to memory of 3048	3000	28028a7cd9a23bde1b0029e6148af986.exe	28
PID 3000 wrote to memory of 3048	3000	28028a7cd9a23bde1b0029e6148af986.exe	28
PID 3000 wrote to memory of 3048	3000	28028a7cd9a23bde1b0029e6148af986.exe	28
PID 3048 wrote to memory of 2056	3048	28028a7cd9a23bde1b0029e6148af986.exe	29
PID 3048 wrote to memory of 2056	3048	28028a7cd9a23bde1b0029e6148af986.exe	29
PID 3048 wrote to memory of 2056	3048	28028a7cd9a23bde1b0029e6148af986.exe	29
PID 3048 wrote to memory of 2056	3048	28028a7cd9a23bde1b0029e6148af986.exe	29
PID 3048 wrote to memory of 2940	3048	28028a7cd9a23bde1b0029e6148af986.exe	30
PID 3048 wrote to memory of 2940	3048	28028a7cd9a23bde1b0029e6148af986.exe	30
PID 3048 wrote to memory of 2940	3048	28028a7cd9a23bde1b0029e6148af986.exe	30
PID 3048 wrote to memory of 2940	3048	28028a7cd9a23bde1b0029e6148af986.exe	30
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32
PID 2056 wrote to memory of 2896	2056	fgspejs.exe	32

C:\Users\Admin\AppData\Local\Temp\28028a7cd9a23bde1b0029e6148af986.exe
"C:\Users\Admin\AppData\Local\Temp\28028a7cd9a23bde1b0029e6148af986.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3000
- C:\Users\Admin\AppData\Local\Temp\28028a7cd9a23bde1b0029e6148af986.exe
  "C:\Users\Admin\AppData\Local\Temp\28028a7cd9a23bde1b0029e6148af986.exe"
  2⤵
  - Modifies WinLogon for persistence
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:3048
- - C:\Users\Admin\fgspejs.exe
    \u
    3⤵
    - Executes dropped EXE
    - Drops file in System32 directory
    - Suspicious use of SetThreadContext
    - Suspicious use of WriteProcessMemory
    PID:2056
  - - C:\Windows\SysWOW64\svchost.exe
      svchost.exe
      4⤵
      PID:2896
- - C:\Windows\SysWOW64\cmd.exe
    cmd /c ""C:\Users\Admin\AppData\Local\Temp\8851.bat" "
    3⤵
    - Deletes itself
    PID:2940

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Winlogon Helper DLL

T1547.004

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\8851.bat

Filesize
103B

MD5
b86a5d966fb77fec5272b6eb04b7b1bf

SHA1
970b514e86b7416fcc99b77c7e22e8e134a5ed5f

SHA256
4b387b0b126bfcef246c2fc93d3b22011efaef1b23b00cac02e49fb5e24144d1

SHA512
fb4a3af3b56ca53ebde0c1058ebb09f1db3dfa1fd0caf41da0275b317fc0b0770919904e1957765be5dddb1ecf8889e27f65545e00b6561e3fef2bcd6683b42d

Download Submit
C:\Windows\SysWOW64\userdiff.sav

Filesize
46KB

MD5
f6bc93b37fa419b9d97d607cc2afa9e9

SHA1
923639e3d775a1d61d3e4d5645e15699f09061df

SHA256
55e230eeae84dac19d600af9a9b46301a030f442458b0054e84a06e1a2115f81

SHA512
d6c4fa1da9ce2cab94fe1611433222f1bc5432a61acd81be9188c580d2708d7ce790e894fcfeec191842b851343645b45403b49935d824f0e6b921710e776b50

Download Submit
\Users\Admin\fgspejs.exe

Filesize
32KB

MD5
4501cf0b9b18b5eb60782d7c03ff998a

SHA1
c981d286a74c6fee7c87e656490f4060f6409c65

SHA256
766e4f856e034a69011543d60a8c191f264e9db520489347d315850cbcd9cb56

SHA512
ba1f33d1679ae1950bfcc832c4c228da07e144fca7237e1f5fcb9efdb64cee9392585e8490fc2a0f2c930d34dc342f8edd94137118b16a8f1a5c1d7a759c2b9f

Download Submit
memory/2056-31-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2056-42-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2056-149-0x0000000000400000-0x0000000000417000-memory.dmp

Filesize
92KB

Download
memory/2896-61-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-56-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-155-0x0000000000130000-0x0000000000131000-memory.dmp

Filesize
4KB

Download
memory/2896-89-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-88-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-87-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-66-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-46-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-47-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-52-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-53-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-50-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-49-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-48-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-51-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-45-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-44-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-54-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-55-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-70-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-57-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-58-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-59-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-60-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-86-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-62-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-63-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-64-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-65-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-85-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-84-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-69-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-68-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-67-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-71-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-72-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-73-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-74-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-75-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-76-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-77-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-78-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-79-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-83-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-82-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-81-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/2896-80-0x0000000009900000-0x000000000990E000-memory.dmp

Filesize
56KB

Download
memory/3048-4-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3048-28-0x0000000000260000-0x0000000000277000-memory.dmp

Filesize
92KB

Download
memory/3048-2-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3048-15-0x00000000001C0000-0x00000000001C1000-memory.dmp

Filesize
4KB

Download
memory/3048-10-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3048-8-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3048-0-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3048-6-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download
memory/3048-30-0x0000000000260000-0x0000000000277000-memory.dmp

Filesize
92KB

Download
memory/3048-39-0x0000000000400000-0x0000000000419000-memory.dmp

Filesize
100KB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads