81831e95c268aa5f19f71bb63814b7f5f2ab8d574d73445493fa672480cda73a

Analysis

max time kernel
0s
max time network
149s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
03/01/2024, 15:18

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

469c894ae9f8265bb67c747d7031583c.exe
Size

96KB
MD5

469c894ae9f8265bb67c747d7031583c
SHA1

581bf8a22c186492168a74f18bbf3dd0256f99de
SHA256

81831e95c268aa5f19f71bb63814b7f5f2ab8d574d73445493fa672480cda73a
SHA512

6adaeab42ef5d14e44060c00ef15f6f8f5734faa89c9677143e06c44ed5419710a049f986821d87b64c00a4f423760e119b3c2336ddffb4b55b9250cc95a32c3
SSDEEP

1536:pw2CSU+mhjmxXf7bJP/EARUEWGt6rgVpuUVRlcmQPkUB:yjVhcXf75/FRUHGt5mUV/uh

Score

10^/10

evasion persistence

Malware Config

Signatures

Modifies firewall policy service 2 TTPs 3 IoCs

evasion

Modify Registry

T1112

Windows Service

T1543.003

description	ioc	Process
Key created	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List	469c894ae9f8265bb67c747d7031583c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\469c894ae9f8265bb67c747d7031583c.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\469c894ae9f8265bb67c747d7031583c.exe:*:Enabled:NVIDIA driver monitor"	469c894ae9f8265bb67c747d7031583c.exe
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\469c894ae9f8265bb67c747d7031583c.exe = "c:\\windows\\nvsvc32.exe:*:Enabled:NVIDIA driver monitor"	469c894ae9f8265bb67c747d7031583c.exe

Modifies Windows Firewall 1 TTPs 2 IoCs

evasion

Windows Service

T1543.003

pid	Process
2704	netsh.exe
1692	netsh.exe

Executes dropped EXE 3 IoCs

pid	Process
2624	nvsvc32.exe
2840	nvsvc32.exe
2000	nvsvc32.exe

Loads dropped DLL 2 IoCs

pid	Process
2232	469c894ae9f8265bb67c747d7031583c.exe
2624	nvsvc32.exe

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\NVIDIA driver monitor = "c:\\windows\\nvsvc32.exe"	469c894ae9f8265bb67c747d7031583c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\NVIDIA driver monitor = "c:\\windows\\nvsvc32.exe"	469c894ae9f8265bb67c747d7031583c.exe

Suspicious use of SetThreadContext 4 IoCs

description	pid	Process	procid_target
PID 2232 set thread context of 1716	2232	469c894ae9f8265bb67c747d7031583c.exe	37
PID 1716 set thread context of 2812	1716	469c894ae9f8265bb67c747d7031583c.exe	36
PID 2624 set thread context of 2840	2624	nvsvc32.exe	18
PID 2840 set thread context of 2000	2840	nvsvc32.exe	19

Drops file in Windows directory 6 IoCs

description	ioc	Process
File created	\??\c:\windows\nvsvc32.exe	469c894ae9f8265bb67c747d7031583c.exe
File opened for modification	\??\c:\windows\nvsvc32.exe	nvsvc32.exe
File opened for modification	\??\c:\windows\ndl.dl	nvsvc32.exe
File opened for modification	\??\c:\windows\ntdl.dl	nvsvc32.exe
File opened for modification	\??\c:\windows\nvsvc32.exe	nvsvc32.exe
File opened for modification	\??\c:\windows\nvsvc32.exe	469c894ae9f8265bb67c747d7031583c.exe

Launches sc.exe 2 IoCs

Sc.exe is a Windows utlilty to control services on the system.

pid	Process
1896	sc.exe
1688	sc.exe

Runs net.exe

Suspicious behavior: EnumeratesProcesses 1 IoCs

pid	Process
2000	nvsvc32.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2232	469c894ae9f8265bb67c747d7031583c.exe
2624	nvsvc32.exe

Suspicious use of WriteProcessMemory 58 IoCs

description	pid	Process	procid_target
PID 2232 wrote to memory of 1716	2232	469c894ae9f8265bb67c747d7031583c.exe	37
PID 2232 wrote to memory of 1716	2232	469c894ae9f8265bb67c747d7031583c.exe	37
PID 2232 wrote to memory of 1716	2232	469c894ae9f8265bb67c747d7031583c.exe	37
PID 2232 wrote to memory of 1716	2232	469c894ae9f8265bb67c747d7031583c.exe	37
PID 2232 wrote to memory of 1716	2232	469c894ae9f8265bb67c747d7031583c.exe	37
PID 2232 wrote to memory of 1716	2232	469c894ae9f8265bb67c747d7031583c.exe	37
PID 2232 wrote to memory of 1716	2232	469c894ae9f8265bb67c747d7031583c.exe	37
PID 2232 wrote to memory of 1716	2232	469c894ae9f8265bb67c747d7031583c.exe	37
PID 1716 wrote to memory of 2812	1716	469c894ae9f8265bb67c747d7031583c.exe	36
PID 1716 wrote to memory of 2812	1716	469c894ae9f8265bb67c747d7031583c.exe	36
PID 1716 wrote to memory of 2812	1716	469c894ae9f8265bb67c747d7031583c.exe	36
PID 1716 wrote to memory of 2812	1716	469c894ae9f8265bb67c747d7031583c.exe	36
PID 1716 wrote to memory of 2812	1716	469c894ae9f8265bb67c747d7031583c.exe	36
PID 1716 wrote to memory of 2812	1716	469c894ae9f8265bb67c747d7031583c.exe	36
PID 1716 wrote to memory of 2812	1716	469c894ae9f8265bb67c747d7031583c.exe	36
PID 1716 wrote to memory of 2812	1716	469c894ae9f8265bb67c747d7031583c.exe	36
PID 1716 wrote to memory of 2812	1716	469c894ae9f8265bb67c747d7031583c.exe	36
PID 2812 wrote to memory of 2704	2812	469c894ae9f8265bb67c747d7031583c.exe	17
PID 2812 wrote to memory of 2704	2812	469c894ae9f8265bb67c747d7031583c.exe	17
PID 2812 wrote to memory of 2704	2812	469c894ae9f8265bb67c747d7031583c.exe	17
PID 2812 wrote to memory of 2704	2812	469c894ae9f8265bb67c747d7031583c.exe	17
PID 2812 wrote to memory of 2624	2812	469c894ae9f8265bb67c747d7031583c.exe	35
PID 2812 wrote to memory of 2624	2812	469c894ae9f8265bb67c747d7031583c.exe	35
PID 2812 wrote to memory of 2624	2812	469c894ae9f8265bb67c747d7031583c.exe	35
PID 2812 wrote to memory of 2624	2812	469c894ae9f8265bb67c747d7031583c.exe	35
PID 2624 wrote to memory of 2840	2624	nvsvc32.exe	18
PID 2624 wrote to memory of 2840	2624	nvsvc32.exe	18
PID 2624 wrote to memory of 2840	2624	nvsvc32.exe	18
PID 2624 wrote to memory of 2840	2624	nvsvc32.exe	18
PID 2624 wrote to memory of 2840	2624	nvsvc32.exe	18
PID 2624 wrote to memory of 2840	2624	nvsvc32.exe	18
PID 2624 wrote to memory of 2840	2624	nvsvc32.exe	18
PID 2624 wrote to memory of 2840	2624	nvsvc32.exe	18
PID 2840 wrote to memory of 2000	2840	nvsvc32.exe	19
PID 2840 wrote to memory of 2000	2840	nvsvc32.exe	19
PID 2840 wrote to memory of 2000	2840	nvsvc32.exe	19
PID 2840 wrote to memory of 2000	2840	nvsvc32.exe	19
PID 2840 wrote to memory of 2000	2840	nvsvc32.exe	19
PID 2840 wrote to memory of 2000	2840	nvsvc32.exe	19
PID 2840 wrote to memory of 2000	2840	nvsvc32.exe	19
PID 2840 wrote to memory of 2000	2840	nvsvc32.exe	19
PID 2840 wrote to memory of 2000	2840	nvsvc32.exe	19
PID 2812 wrote to memory of 2924	2812	469c894ae9f8265bb67c747d7031583c.exe	34
PID 2812 wrote to memory of 2924	2812	469c894ae9f8265bb67c747d7031583c.exe	34
PID 2812 wrote to memory of 2924	2812	469c894ae9f8265bb67c747d7031583c.exe	34
PID 2812 wrote to memory of 2924	2812	469c894ae9f8265bb67c747d7031583c.exe	34
PID 2000 wrote to memory of 1692	2000	nvsvc32.exe	33
PID 2000 wrote to memory of 1692	2000	nvsvc32.exe	33
PID 2000 wrote to memory of 1692	2000	nvsvc32.exe	33
PID 2000 wrote to memory of 1692	2000	nvsvc32.exe	33
PID 2000 wrote to memory of 1516	2000	nvsvc32.exe	32
PID 2000 wrote to memory of 1516	2000	nvsvc32.exe	32
PID 2000 wrote to memory of 1516	2000	nvsvc32.exe	32
PID 2000 wrote to memory of 1516	2000	nvsvc32.exe	32
PID 2000 wrote to memory of 300	2000	nvsvc32.exe	20
PID 2000 wrote to memory of 300	2000	nvsvc32.exe	20
PID 2000 wrote to memory of 300	2000	nvsvc32.exe	20
PID 2000 wrote to memory of 300	2000	nvsvc32.exe	20

C:\Users\Admin\AppData\Local\Temp\469c894ae9f8265bb67c747d7031583c.exe
"C:\Users\Admin\AppData\Local\Temp\469c894ae9f8265bb67c747d7031583c.exe"
1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2232
- C:\Users\Admin\AppData\Local\Temp\469c894ae9f8265bb67c747d7031583c.exe
  "C:\Users\Admin\AppData\Local\Temp\469c894ae9f8265bb67c747d7031583c.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of WriteProcessMemory
  PID:1716

C:\Windows\SysWOW64\netsh.exe
netsh firewall add allowedprogram 1.exe 1 ENABLE
1⤵
- Modifies Windows Firewall
PID:2704

\??\c:\windows\nvsvc32.exe
"c:\windows\nvsvc32.exe"
1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2840
- \??\c:\windows\nvsvc32.exe
  "c:\windows\nvsvc32.exe"
  2⤵
  - Executes dropped EXE
  - Drops file in Windows directory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2000
- - C:\Windows\SysWOW64\net.exe
    net stop MsMpSvc
    3⤵
    PID:300
  - - C:\Windows\SysWOW64\net1.exe
      C:\Windows\system32\net1 stop MsMpSvc
      4⤵
      PID:2900
- - C:\Windows\SysWOW64\sc.exe
    sc config MsMpSvc start= disabled
    3⤵
    - Launches sc.exe
    PID:1896
- - C:\Windows\SysWOW64\sc.exe
    sc config wuauserv start= disabled
    3⤵
    - Launches sc.exe
    PID:1688
- - C:\Windows\SysWOW64\net.exe
    net stop wuauserv
    3⤵
    PID:1516
- - C:\Windows\SysWOW64\netsh.exe
    netsh firewall add allowedprogram 1.exe 1 ENABLE
    3⤵
    - Modifies Windows Firewall
    PID:1692

C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:2
1⤵
PID:1256

C:\Program Files\Internet Explorer\iexplore.exe
"C:\Program Files\Internet Explorer\iexplore.exe" http://browseusers.myspace.com/Browse/Browse.aspx
1⤵
PID:2672

C:\Windows\SysWOW64\net1.exe
C:\Windows\system32\net1 stop wuauserv
1⤵
PID:2036

C:\Windows\explorer.exe
C:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding
1⤵
PID:1684

C:\Windows\SysWOW64\explorer.exe
explorer.exe http://browseusers.myspace.com/Browse/Browse.aspx
1⤵
PID:2924

\??\c:\windows\nvsvc32.exe
"c:\windows\nvsvc32.exe"
1⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2624

C:\Users\Admin\AppData\Local\Temp\469c894ae9f8265bb67c747d7031583c.exe
"C:\Users\Admin\AppData\Local\Temp\469c894ae9f8265bb67c747d7031583c.exe"
1⤵
- Modifies firewall policy service
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:2812

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Create or Modify System Process

T1543

Windows Service

T1543.003

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\m681C7D17fi.txt

Filesize
2KB

MD5
bdde2ed854b22d6a874ff53a46c138ba

SHA1
65e9841692a51254d594dd40a3f7e51e8e7c3efe

SHA256
08b716b67065a6bdb86a3cb3b3737c7c51c36228047dfefb3203a852ed67ba88

SHA512
e541d91dd91c2865efaa4945aa3a419397616eeee7840ef346675c4d07bcb592fe84f5a6e234f1e241b9175f10c82c048146842e2ce5b9bf940ca5a2cd272003

Download Submit
memory/1716-5-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1716-40-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1716-41-0x00000000003F0000-0x0000000000400000-memory.dmp

Filesize
64KB

Download
memory/1716-15-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1716-7-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1716-11-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/1716-9-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/1716-13-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download
memory/2000-2423-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2000-247-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2000-105-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2000-111-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2000-110-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2812-112-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2812-29-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2812-31-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2812-33-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2812-35-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2812-39-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2812-46-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2812-47-0x0000000000400000-0x00000000006F8000-memory.dmp

Filesize
3.0MB

Download
memory/2840-93-0x00000000008B0000-0x00000000008C0000-memory.dmp

Filesize
64KB

Download
memory/2840-92-0x0000000000400000-0x0000000000412000-memory.dmp

Filesize
72KB

Download