Analysis
-
max time kernel
43s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 12:34
Static task
static1
Behavioral task
behavioral1
Sample
365125e7e643360d091c0acb362bbb33.exe
Resource
win7-20231215-en
General
-
Target
365125e7e643360d091c0acb362bbb33.exe
-
Size
100KB
-
MD5
365125e7e643360d091c0acb362bbb33
-
SHA1
e5311ac0aedeae9bda98daa3daca9b60b31f61d1
-
SHA256
48685c08f2a94a1592735553868fb6d0af367152045332815a49d1fc2de979a4
-
SHA512
d7489cc244325cfa4427e9e897d14d1512d4ea7756b15452af28e10480f1d6372aed820d4851d1f27d177cb25cb6122314ef833cfef007b821988dac15a6c3f7
-
SSDEEP
3072:vmV+RlGX9CqAP5vu5pQwrOGVk8jwaaHw7Koj4rDMIZwS:+kPGXYVhvYozx
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\ncxkuhnf\\vipwfkwv.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vipwfkwv.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vipwfkwv.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
nnnrhmycdwyimrim.exepid process 2596 nnnrhmycdwyimrim.exe -
Loads dropped DLL 5 IoCs
Processes:
365125e7e643360d091c0acb362bbb33.exepid process 2512 365125e7e643360d091c0acb362bbb33.exe 2512 365125e7e643360d091c0acb362bbb33.exe 2512 365125e7e643360d091c0acb362bbb33.exe 2512 365125e7e643360d091c0acb362bbb33.exe 2512 365125e7e643360d091c0acb362bbb33.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\VipWfkwv = "C:\\Users\\Admin\\AppData\\Local\\ncxkuhnf\\vipwfkwv.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 22 IoCs
Processes:
svchost.exepid process 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe 2676 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 484 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
365125e7e643360d091c0acb362bbb33.exesvchost.exesvchost.exennnrhmycdwyimrim.exedescription pid process Token: SeSecurityPrivilege 2512 365125e7e643360d091c0acb362bbb33.exe Token: SeDebugPrivilege 2512 365125e7e643360d091c0acb362bbb33.exe Token: SeSecurityPrivilege 2404 svchost.exe Token: SeSecurityPrivilege 2676 svchost.exe Token: SeDebugPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeSecurityPrivilege 2596 nnnrhmycdwyimrim.exe Token: SeLoadDriverPrivilege 2596 nnnrhmycdwyimrim.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe Token: SeBackupPrivilege 2676 svchost.exe Token: SeRestorePrivilege 2676 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
365125e7e643360d091c0acb362bbb33.exedescription pid process target process PID 2512 wrote to memory of 2404 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2404 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2404 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2404 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2404 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2404 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2404 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2404 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2404 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2404 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2676 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2676 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2676 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2676 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2676 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2676 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2676 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2676 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2676 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2676 2512 365125e7e643360d091c0acb362bbb33.exe svchost.exe PID 2512 wrote to memory of 2596 2512 365125e7e643360d091c0acb362bbb33.exe nnnrhmycdwyimrim.exe PID 2512 wrote to memory of 2596 2512 365125e7e643360d091c0acb362bbb33.exe nnnrhmycdwyimrim.exe PID 2512 wrote to memory of 2596 2512 365125e7e643360d091c0acb362bbb33.exe nnnrhmycdwyimrim.exe PID 2512 wrote to memory of 2596 2512 365125e7e643360d091c0acb362bbb33.exe nnnrhmycdwyimrim.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\365125e7e643360d091c0acb362bbb33.exe"C:\Users\Admin\AppData\Local\Temp\365125e7e643360d091c0acb362bbb33.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\nnnrhmycdwyimrim.exe"C:\Users\Admin\AppData\Local\Temp\nnnrhmycdwyimrim.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/2404-22-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2404-21-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2404-6-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2404-17-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2404-19-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2404-14-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2404-16-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2404-23-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2404-4-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2512-13-0x0000000076EC0000-0x0000000076EC1000-memory.dmpFilesize
4KB
-
memory/2512-68-0x0000000002A80000-0x0000000002ABB000-memory.dmpFilesize
236KB
-
memory/2512-1-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/2512-2-0x00000000003F0000-0x00000000003F1000-memory.dmpFilesize
4KB
-
memory/2512-11-0x0000000076EBF000-0x0000000076EC0000-memory.dmpFilesize
4KB
-
memory/2512-51-0x0000000076EC0000-0x0000000076EC1000-memory.dmpFilesize
4KB
-
memory/2512-67-0x0000000002A80000-0x0000000002ABB000-memory.dmpFilesize
236KB
-
memory/2512-9-0x0000000000260000-0x0000000000262000-memory.dmpFilesize
8KB
-
memory/2512-69-0x0000000000400000-0x000000000043A698-memory.dmpFilesize
233KB
-
memory/2512-7-0x0000000000400000-0x000000000043A698-memory.dmpFilesize
233KB
-
memory/2596-75-0x0000000000270000-0x0000000000272000-memory.dmpFilesize
8KB
-
memory/2596-74-0x0000000000400000-0x000000000043A698-memory.dmpFilesize
233KB
-
memory/2596-77-0x0000000000400000-0x000000000043A698-memory.dmpFilesize
233KB
-
memory/2596-73-0x0000000000400000-0x000000000043A698-memory.dmpFilesize
233KB
-
memory/2676-81-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-89-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-42-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-43-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-49-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-87-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-85-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-78-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-83-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-27-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-79-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-33-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-91-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-92-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-93-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-90-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2676-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB