Analysis
- max time kernel
1s - max time network
10s - platform
windows10-2004_x64 - resource
win10v2004-20231222-en - resource tags
- submitted
02/01/2024, 15:57
General
- Target 7dde2cadb794e170aadfa6453a767d3c.exe
- Size 940KB
- Sample240102-td5p5shcfm
- SHA256 94bfdd9963e0a7fe4ee4488edbeebbd5b0d69fc8f5325f4006f159d4e2067236
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- UPX packed file 4 IoCs
Detects executables packed with UPX/modified UPX open source packer.
- Suspicious use of SetThreadContext 1 IoCs
- Modifies registry key 1 TTPs 4 IoCs
- Suspicious use of AdjustPrivilegeToken 36 IoCs
- Suspicious use of SetWindowsHookEx 3 IoCs
- Suspicious use of WriteProcessMemory 12 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\7dde2cadb794e170aadfa6453a767d3c.exe"C:\Users\Admin\AppData\Local\Temp\7dde2cadb794e170aadfa6453a767d3c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\7dde2cadb794e170aadfa6453a767d3c.exeC:\Users\Admin\AppData\Local\Temp\7dde2cadb794e170aadfa6453a767d3c.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\7dde2cadb794e170aadfa6453a767d3c.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\7dde2cadb794e170aadfa6453a767d3c.exe:*:Enabled:Windows Messanger" /f3⤵
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
-
-
-
C:\Users\Admin\AppData\Local\Temp\K7W3326XSO.exeC:\Users\Admin\AppData\Local\Temp\K7W3326XSO.exe1⤵
- Executes dropped EXE
-
C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe"C:\Users\Admin\AppData\Local\Temp\RarSFX0\adesao.exe"2⤵
-
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f1⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\7dde2cadb794e170aadfa6453a767d3c.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\7dde2cadb794e170aadfa6453a767d3c.exe:*:Enabled:Windows Messanger" /f1⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f1⤵
- Modifies registry key
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f1⤵
- Modifies registry key
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
memory/400-32-0x0000000000400000-0x00000000005A9000-memory.dmp
memory/400-40-0x00000000024B0000-0x00000000024B1000-memory.dmp
memory/400-39-0x0000000000400000-0x00000000005A9000-memory.dmp
memory/400-28-0x00000000024B0000-0x00000000024B1000-memory.dmp
memory/1632-18-0x0000000075AF0000-0x0000000075BE0000-memory.dmp
memory/1632-42-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-2-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-29-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-20-0x00000000776B6000-0x00000000776B7000-memory.dmp
memory/1632-33-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-35-0x0000000076D60000-0x0000000076DDA000-memory.dmp
memory/1632-34-0x0000000075AF0000-0x0000000075BE0000-memory.dmp
memory/1632-5-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-36-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-6-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-19-0x0000000076D60000-0x0000000076DDA000-memory.dmp
memory/1632-46-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-50-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-55-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-59-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-63-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-68-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-72-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-76-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-80-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-85-0x0000000000400000-0x0000000000473000-memory.dmp
memory/1632-89-0x0000000000400000-0x0000000000473000-memory.dmp