Analysis
-
max time kernel
166s -
max time network
189s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-01-2024 00:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
3b790506f2a6039ae123c2663e43fcf6.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
3b790506f2a6039ae123c2663e43fcf6.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
3b790506f2a6039ae123c2663e43fcf6.exe
-
Size
1.1MB
-
MD5
3b790506f2a6039ae123c2663e43fcf6
-
SHA1
0795420c4a2c66b34fb2a16caaab265dd888dc55
-
SHA256
c26c21ee05b241fbcce9a2ca787a120ea47013f3108b2f96e742a71d8a7ad14b
-
SHA512
1c065804e3e25ccf237f688eb7cbd0ab7ec7cdcb5fbf928d206c3f586fd9b8ed9e69b533aa2873b0d46fbf9960e103ec6fec9cb3b30a35e7ddf5ca930cb3fba7
-
SSDEEP
24576:7+QIbfPY5Beqrrel6qAh5MQwFlN0hY/jFvaX:7/IECqrClah52X00BvaX
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 2752 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\95824a4a9d32c6c20d232fa8b9024775.exe 3b790506f2a6039ae123c2663e43fcf6.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\95824a4a9d32c6c20d232fa8b9024775.exe 3b790506f2a6039ae123c2663e43fcf6.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\95824a4a9d32c6c20d232fa8b9024775 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3b790506f2a6039ae123c2663e43fcf6.exe\" .." 3b790506f2a6039ae123c2663e43fcf6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\95824a4a9d32c6c20d232fa8b9024775 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\3b790506f2a6039ae123c2663e43fcf6.exe\" .." 3b790506f2a6039ae123c2663e43fcf6.exe -
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File opened for modification F:\autorun.inf 3b790506f2a6039ae123c2663e43fcf6.exe File created C:\autorun.inf 3b790506f2a6039ae123c2663e43fcf6.exe File opened for modification C:\autorun.inf 3b790506f2a6039ae123c2663e43fcf6.exe File created D:\autorun.inf 3b790506f2a6039ae123c2663e43fcf6.exe File created F:\autorun.inf 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious use of NtSetInformationThreadHideFromDebugger 15 IoCs
pid Process 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe 1800 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1800 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: 33 1800 3b790506f2a6039ae123c2663e43fcf6.exe Token: SeIncBasePriorityPrivilege 1800 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1800 3b790506f2a6039ae123c2663e43fcf6.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1800 wrote to memory of 2752 1800 3b790506f2a6039ae123c2663e43fcf6.exe 28 PID 1800 wrote to memory of 2752 1800 3b790506f2a6039ae123c2663e43fcf6.exe 28 PID 1800 wrote to memory of 2752 1800 3b790506f2a6039ae123c2663e43fcf6.exe 28 PID 1800 wrote to memory of 2752 1800 3b790506f2a6039ae123c2663e43fcf6.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\3b790506f2a6039ae123c2663e43fcf6.exe"C:\Users\Admin\AppData\Local\Temp\3b790506f2a6039ae123c2663e43fcf6.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1800 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3b790506f2a6039ae123c2663e43fcf6.exe" "3b790506f2a6039ae123c2663e43fcf6.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:2752
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD53b790506f2a6039ae123c2663e43fcf6
SHA10795420c4a2c66b34fb2a16caaab265dd888dc55
SHA256c26c21ee05b241fbcce9a2ca787a120ea47013f3108b2f96e742a71d8a7ad14b
SHA5121c065804e3e25ccf237f688eb7cbd0ab7ec7cdcb5fbf928d206c3f586fd9b8ed9e69b533aa2873b0d46fbf9960e103ec6fec9cb3b30a35e7ddf5ca930cb3fba7