Analysis
-
max time kernel
151s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
05-01-2024 02:51
Static task
static1
Behavioral task
behavioral1
Sample
4293b792ab131741da2eda5f6dde7c87.exe
Resource
win7-20231215-en
General
-
Target
4293b792ab131741da2eda5f6dde7c87.exe
-
Size
94KB
-
MD5
4293b792ab131741da2eda5f6dde7c87
-
SHA1
ae19da32badbaf720e7339c56e86654c579ed6a6
-
SHA256
c250a4606ea37c51fa0b4afb1739597014abfe04424cbabd502b1a6382758635
-
SHA512
af27032eaf3d0badb3a386df760c1f260c540307858eec9301fdbcb4748ec2602367c3f4bffe5de9767651c15e821a0069baf29c669b39f3823232c5499cf6af
-
SSDEEP
1536:xQ+if/nwvn32SVo6CFDR/SwSz+e2dAS3F4ozjlFBN9WG5E8k8jwaaHw7Koj4rrw3:xQ5fqGko6CFgQeGV4UlFBNAGFk8jwaa9
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\mpxjliva\\vhowfytc.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vhowfytc.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\vhowfytc.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
nmmrhbvivvdlwtsq.exepid process 1652 nmmrhbvivvdlwtsq.exe -
Loads dropped DLL 4 IoCs
Processes:
4293b792ab131741da2eda5f6dde7c87.exepid process 1852 4293b792ab131741da2eda5f6dde7c87.exe 1852 4293b792ab131741da2eda5f6dde7c87.exe 1852 4293b792ab131741da2eda5f6dde7c87.exe 1852 4293b792ab131741da2eda5f6dde7c87.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2444714103-3190537498-3629098939-1000\Software\Microsoft\Windows\CurrentVersion\Run\VhoWfytc = "C:\\Users\\Admin\\AppData\\Local\\mpxjliva\\vhowfytc.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 464 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
4293b792ab131741da2eda5f6dde7c87.exesvchost.exesvchost.exenmmrhbvivvdlwtsq.exedescription pid process Token: SeSecurityPrivilege 1852 4293b792ab131741da2eda5f6dde7c87.exe Token: SeDebugPrivilege 1852 4293b792ab131741da2eda5f6dde7c87.exe Token: SeSecurityPrivilege 3032 svchost.exe Token: SeSecurityPrivilege 2756 svchost.exe Token: SeDebugPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeSecurityPrivilege 1652 nmmrhbvivvdlwtsq.exe Token: SeLoadDriverPrivilege 1652 nmmrhbvivvdlwtsq.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
4293b792ab131741da2eda5f6dde7c87.exedescription pid process target process PID 1852 wrote to memory of 3032 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 3032 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 3032 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 3032 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 3032 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 3032 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 3032 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 3032 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 3032 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 3032 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 2756 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 2756 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 2756 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 2756 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 2756 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 2756 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 2756 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 2756 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 2756 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 2756 1852 4293b792ab131741da2eda5f6dde7c87.exe svchost.exe PID 1852 wrote to memory of 1652 1852 4293b792ab131741da2eda5f6dde7c87.exe nmmrhbvivvdlwtsq.exe PID 1852 wrote to memory of 1652 1852 4293b792ab131741da2eda5f6dde7c87.exe nmmrhbvivvdlwtsq.exe PID 1852 wrote to memory of 1652 1852 4293b792ab131741da2eda5f6dde7c87.exe nmmrhbvivvdlwtsq.exe PID 1852 wrote to memory of 1652 1852 4293b792ab131741da2eda5f6dde7c87.exe nmmrhbvivvdlwtsq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\4293b792ab131741da2eda5f6dde7c87.exe"C:\Users\Admin\AppData\Local\Temp\4293b792ab131741da2eda5f6dde7c87.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\nmmrhbvivvdlwtsq.exe"C:\Users\Admin\AppData\Local\Temp\nmmrhbvivvdlwtsq.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\mpxjliva\vhowfytc.exeFilesize
94KB
MD54293b792ab131741da2eda5f6dde7c87
SHA1ae19da32badbaf720e7339c56e86654c579ed6a6
SHA256c250a4606ea37c51fa0b4afb1739597014abfe04424cbabd502b1a6382758635
SHA512af27032eaf3d0badb3a386df760c1f260c540307858eec9301fdbcb4748ec2602367c3f4bffe5de9767651c15e821a0069baf29c669b39f3823232c5499cf6af
-
memory/1652-88-0x0000000000400000-0x0000000000439AE8-memory.dmpFilesize
230KB
-
memory/1652-85-0x00000000001C0000-0x00000000001C2000-memory.dmpFilesize
8KB
-
memory/1852-74-0x0000000000230000-0x0000000000232000-memory.dmpFilesize
8KB
-
memory/1852-81-0x0000000077A7F000-0x0000000077A80000-memory.dmpFilesize
4KB
-
memory/1852-6-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/1852-1-0x0000000000400000-0x0000000000439AE8-memory.dmpFilesize
230KB
-
memory/1852-2-0x0000000000230000-0x0000000000232000-memory.dmpFilesize
8KB
-
memory/1852-5-0x0000000077A7F000-0x0000000077A80000-memory.dmpFilesize
4KB
-
memory/1852-0-0x0000000000400000-0x0000000000439AE8-memory.dmpFilesize
230KB
-
memory/1852-73-0x0000000002690000-0x00000000026CA000-memory.dmpFilesize
232KB
-
memory/1852-72-0x0000000002690000-0x00000000026CA000-memory.dmpFilesize
232KB
-
memory/1852-71-0x0000000000400000-0x0000000000439AE8-memory.dmpFilesize
230KB
-
memory/1852-7-0x0000000077A80000-0x0000000077A81000-memory.dmpFilesize
4KB
-
memory/1852-53-0x0000000077A80000-0x0000000077A81000-memory.dmpFilesize
4KB
-
memory/1852-4-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2756-89-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-63-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-56-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-44-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-50-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-54-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-57-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-59-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-61-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-43-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-93-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-34-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-92-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-91-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-90-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-55-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-28-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/3032-9-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3032-11-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/3032-15-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3032-17-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/3032-24-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3032-22-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3032-20-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/3032-23-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/3032-19-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB