Analysis
-
max time kernel
122s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
31-12-2023 13:29
Behavioral task
behavioral1
Sample
9a217cf11b0abe9da14ce4ffea4233a7.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9a217cf11b0abe9da14ce4ffea4233a7.exe
Resource
win10v2004-20231215-en
General
-
Target
9a217cf11b0abe9da14ce4ffea4233a7.exe
-
Size
251KB
-
MD5
9a217cf11b0abe9da14ce4ffea4233a7
-
SHA1
d8b98ae3ff4250d73ad144dbf55afe049d440fc8
-
SHA256
b3f098d7108cb12704938864b6375b27395b54ab92af9aa5dd3334442be490bd
-
SHA512
c646388b8ecfcaf40f63b23b83d79d14be5f6dfaece67d47cefcea505c8fe25f8a1c82a8c0fb8f7b86a6b75cc81d2b6c5d6a087da8ee4c644763ce35d3ef94e3
-
SSDEEP
6144:qb9iXkv6DOSCyJFDVhtc9HZlXqBLLXP1MxH:qb9EkKFFXtIHCje
Malware Config
Signatures
-
resource yara_rule behavioral1/files/0x0009000000012252-13.dat aspack_v212_v242 behavioral1/files/0x0007000000016d20-16.dat aspack_v212_v242 -
Executes dropped EXE 1 IoCs
pid Process 2820 wininit.exe -
Loads dropped DLL 4 IoCs
pid Process 2800 Regsvr32.exe 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 2120 Regsvr32.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\FHL.EXE = "C:\\$Recycle.Bin\\wininit.exe" 9a217cf11b0abe9da14ce4ffea4233a7.exe -
Enumerates connected drives 3 TTPs 34 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\T: wininit.exe File opened (read-only) \??\U: wininit.exe File opened (read-only) \??\I: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\E: wininit.exe File opened (read-only) \??\G: wininit.exe File opened (read-only) \??\K: wininit.exe File opened (read-only) \??\M: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\R: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\N: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\Q: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\V: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\J: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\O: wininit.exe File opened (read-only) \??\H: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\P: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\L: wininit.exe File opened (read-only) \??\M: wininit.exe File opened (read-only) \??\E: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\G: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\L: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\U: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\T: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\I: wininit.exe File opened (read-only) \??\P: wininit.exe File opened (read-only) \??\V: wininit.exe File opened (read-only) \??\J: wininit.exe File opened (read-only) \??\N: wininit.exe File opened (read-only) \??\Q: wininit.exe File opened (read-only) \??\R: wininit.exe File opened (read-only) \??\K: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\O: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\S: 9a217cf11b0abe9da14ce4ffea4233a7.exe File opened (read-only) \??\H: wininit.exe File opened (read-only) \??\S: wininit.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\FHL.EXE 9a217cf11b0abe9da14ce4ffea4233a7.exe File created C:\Windows\SysWOW64\Ms7002.dll 9a217cf11b0abe9da14ce4ffea4233a7.exe File created C:\Windows\SysWOW64\BWNXRH.EXE wininit.exe -
Modifies registry class 46 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell wininit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command\ = "C:\\PerfLogs\\YUA.EXE %1" 9a217cf11b0abe9da14ce4ffea4233a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command\ = "C:\\System Volume Information\\YVIYML.EXE \"%1\"" 9a217cf11b0abe9da14ce4ffea4233a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ProgID Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ProgID\ = "Ms7002.ShellExecuteHook" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open 9a217cf11b0abe9da14ce4ffea4233a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785} Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file 9a217cf11b0abe9da14ce4ffea4233a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command\ = "C:\\System Volume Information\\YVIYML.EXE \"%1\"" 9a217cf11b0abe9da14ce4ffea4233a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile 9a217cf11b0abe9da14ce4ffea4233a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell 9a217cf11b0abe9da14ce4ffea4233a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32 Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\Clsid Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command 9a217cf11b0abe9da14ce4ffea4233a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command 9a217cf11b0abe9da14ce4ffea4233a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command 9a217cf11b0abe9da14ce4ffea4233a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\QPWorkFile\qp7002 = "C:\\Windows\\SysWow64\\FHL.EXE" 9a217cf11b0abe9da14ce4ffea4233a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32\ = "C:\\Windows\\SysWow64\\Ms7002.dll" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\InprocServer32\ThreadingModel = "Apartment" Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\Clsid\ = "{7CD4138D-4147-420B-9749-00A13B526785}" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open\command wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\txtfile\shell\open\command 9a217cf11b0abe9da14ce4ffea4233a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{7CD4138D-4147-420B-9749-00A13B526785}\ = "MaiHook7002" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook Regsvr32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Ms7002.ShellExecuteHook\ = "MaiHook7002" Regsvr32.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile\shell\open\command wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\regfile\shell\open wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\chm.file\shell\open\command 9a217cf11b0abe9da14ce4ffea4233a7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\inifile\shell\open\command\ = "C:\\System Volume Information\\YVIYML.EXE %1" 9a217cf11b0abe9da14ce4ffea4233a7.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\scrfile wininit.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\inifile wininit.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 2820 wininit.exe 2820 wininit.exe -
Suspicious use of WriteProcessMemory 18 IoCs
description pid Process procid_target PID 3068 wrote to memory of 2800 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 28 PID 3068 wrote to memory of 2800 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 28 PID 3068 wrote to memory of 2800 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 28 PID 3068 wrote to memory of 2800 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 28 PID 3068 wrote to memory of 2800 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 28 PID 3068 wrote to memory of 2800 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 28 PID 3068 wrote to memory of 2800 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 28 PID 3068 wrote to memory of 2820 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 29 PID 3068 wrote to memory of 2820 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 29 PID 3068 wrote to memory of 2820 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 29 PID 3068 wrote to memory of 2820 3068 9a217cf11b0abe9da14ce4ffea4233a7.exe 29 PID 2820 wrote to memory of 2120 2820 wininit.exe 30 PID 2820 wrote to memory of 2120 2820 wininit.exe 30 PID 2820 wrote to memory of 2120 2820 wininit.exe 30 PID 2820 wrote to memory of 2120 2820 wininit.exe 30 PID 2820 wrote to memory of 2120 2820 wininit.exe 30 PID 2820 wrote to memory of 2120 2820 wininit.exe 30 PID 2820 wrote to memory of 2120 2820 wininit.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a217cf11b0abe9da14ce4ffea4233a7.exe"C:\Users\Admin\AppData\Local\Temp\9a217cf11b0abe9da14ce4ffea4233a7.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32.exe C:\Windows\system32\Ms7002.dll /s2⤵
- Loads dropped DLL
- Modifies registry class
PID:2800
-
-
C:\$Recycle.Bin\wininit.exeC:\$Recycle.Bin\wininit.exe2⤵
- Executes dropped EXE
- Enumerates connected drives
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2820 -
C:\Windows\SysWOW64\Regsvr32.exeRegsvr32.exe C:\Windows\system32\Ms7002.dll /s3⤵
- Loads dropped DLL
PID:2120
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
251KB
MD5705e95e8020ace45e820a0351f6dcea9
SHA182485383761883cad04d28d7bdbacf6e372d2072
SHA256c9c3013161725a075099b39ffc3dbb054ade2b42e5d69adac58591b6769e2b25
SHA512d90811be574222948a2205e5f3c48396788c3791915dfd508bd7e918032614f420efdab5730222a2c0a28253ddbd64972c2a3faae918a033ccf778142392d8e2
-
Filesize
52KB
MD5876a2a99b81968f5b26e3cbe12063d2b
SHA17afa8f33b691b2651b65eb07220cc2fda4b7537c
SHA256f0a7ec2edff7699e546221808f45ca8816a75eb519618283d7c4514dfb9134e0
SHA512ca0574dbb5ff4b146679ffc38aa794e64470949cd228518d04d3680d63a1ce2f076e38494fa5b6cd0722c2dc3e35c5b5c3b63483c1fa7dc62bca42c4cf8e0ce1