Analysis
-
max time kernel
146s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06/01/2024, 05:23
Behavioral task
behavioral1
Sample
9E7DE6D79CCC935FA7C1B629155CA2EF.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
9E7DE6D79CCC935FA7C1B629155CA2EF.exe
Resource
win10v2004-20231222-en
General
-
Target
9E7DE6D79CCC935FA7C1B629155CA2EF.exe
-
Size
203KB
-
MD5
9e7de6d79ccc935fa7c1b629155ca2ef
-
SHA1
09e1a1d16d81e0c7213cd2664bc47e5ce69165ed
-
SHA256
52bed4d9c0fdb81bdc4abfd46b47b8f8fa2dcdd570fcdc94f300f087c8b3aa65
-
SHA512
58f320b34ee14c21fb69e25afab572a3c91d8f78817c365b49d35b969d5b95cf4298d34a9a437b7e2d1f3113ecdad13d63e05dbfbe50925b3c780e69664d7853
-
SSDEEP
6144:sLV6Bta6dtJmakIM5qDr7rb2Wdkytz9spP:sLV6Btpmk7mWltY
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LAN Service = "C:\\Program Files (x86)\\LAN Service\\lansv.exe" 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\LAN Service\lansv.exe 9E7DE6D79CCC935FA7C1B629155CA2EF.exe File opened for modification C:\Program Files (x86)\LAN Service\lansv.exe 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2160 schtasks.exe 2044 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 2088 wrote to memory of 2044 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 22 PID 2088 wrote to memory of 2044 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 22 PID 2088 wrote to memory of 2044 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 22 PID 2088 wrote to memory of 2044 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 22 PID 2088 wrote to memory of 2160 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 21 PID 2088 wrote to memory of 2160 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 21 PID 2088 wrote to memory of 2160 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 21 PID 2088 wrote to memory of 2160 2088 9E7DE6D79CCC935FA7C1B629155CA2EF.exe 21
Processes
-
C:\Users\Admin\AppData\Local\Temp\9E7DE6D79CCC935FA7C1B629155CA2EF.exe"C:\Users\Admin\AppData\Local\Temp\9E7DE6D79CCC935FA7C1B629155CA2EF.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2088 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "LAN Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1D9F.tmp"2⤵
- Creates scheduled task(s)
PID:2160
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "LAN Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp1D22.tmp"2⤵
- Creates scheduled task(s)
PID:2044
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD551b770160f6c0ba58a36b76b46dd55a8
SHA1b95f69729b634ae959f82586d87100c571d3d1e5
SHA25684466b7f8bcab52aeda5aac066bcea6281c0068062250d0a3486bd346bcd9170
SHA512ba9f2216b4d797ae7cd3ef6d958e23df223d8ca89981600aa3de6b228e8694f672b673ea03e23c86a2797e389a869c0f8565926788d6e607a089612d325d6553
-
Filesize
1KB
MD56b30dba7972c92c9a1b881e88c108b15
SHA1f76207985cc5a1f70edb2fb5bd45678f195a4564
SHA256578f5b0ff051f02f8e0a67fc3424dad554fa9489875475ea624fbb63eabfcbf7
SHA512e3dd368937f863cb07453de12173580fb63b8d3983db7119c24860f227c89ded76401c47607f5b1134d215d46fe2b40d4bc3d7299374f1e8abecdeaefc7b9099