Analysis
- max time kernel
140s - max time network
108s - platform
windows10-2004_x64 - resource
win10v2004-20231215-en - resource tags
- submitted
06/01/2024, 07:09
General
- Target 459917e891be89478c96c6a2f3ba8c60.exe
- Size 633KB
- Sample240106-hy51vsaghm
- SHA256 7fbde55aebcbb096dd62041cdd5d08fcfd5777fc2ccefc35eb071ef27573e123
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Drops file in System32 directory 4 IoCs
- Drops file in Windows directory 3 IoCs
- Modifies data under HKEY_USERS 8 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of FindShellTrayWindow 1 IoCs
- Suspicious use of WriteProcessMemory 5 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\459917e891be89478c96c6a2f3ba8c60.exe"C:\Users\Admin\AppData\Local\Temp\459917e891be89478c96c6a2f3ba8c60.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat2⤵
-
-
C:\Windows\svchost.exeC:\Windows\svchost.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Program Files\Internet Explorer\IexplOrE.ExE"C:\Program Files\Internet Explorer\IexplOrE.ExE"2⤵
-
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
svchost.exe
svchost.exe
uninstal.bat
memory/2600-18-0x0000000003540000-0x0000000003541000-memory.dmp
memory/2600-3-0x0000000002550000-0x0000000002551000-memory.dmp
memory/2600-6-0x0000000002520000-0x0000000002521000-memory.dmp
memory/2600-5-0x0000000002530000-0x0000000002531000-memory.dmp
memory/2600-7-0x0000000002590000-0x0000000002591000-memory.dmp
memory/2600-8-0x0000000002580000-0x0000000002581000-memory.dmp
memory/2600-9-0x00000000025B0000-0x00000000025B1000-memory.dmp
memory/2600-10-0x0000000002540000-0x0000000002541000-memory.dmp
memory/2600-21-0x0000000002720000-0x0000000002721000-memory.dmp
memory/2600-12-0x0000000003500000-0x0000000003503000-memory.dmp
memory/2600-13-0x0000000003600000-0x0000000003601000-memory.dmp
memory/2600-16-0x00000000007A0000-0x00000000007A1000-memory.dmp
memory/2600-17-0x0000000000AF0000-0x0000000000AF1000-memory.dmp
memory/2600-0-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2600-4-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/2600-19-0x0000000003530000-0x0000000003531000-memory.dmp
memory/2600-11-0x0000000003510000-0x0000000003511000-memory.dmp
memory/2600-20-0x0000000003520000-0x0000000003521000-memory.dmp
memory/2600-33-0x0000000000400000-0x000000000051C000-memory.dmp
memory/2600-1-0x0000000002330000-0x0000000002384000-memory.dmp
memory/2600-34-0x0000000002330000-0x0000000002384000-memory.dmp
memory/2600-2-0x0000000002570000-0x0000000002571000-memory.dmp
memory/3832-27-0x00000000025A0000-0x00000000025A1000-memory.dmp
memory/3832-26-0x0000000002660000-0x0000000002661000-memory.dmp
memory/3832-25-0x0000000002570000-0x0000000002571000-memory.dmp
memory/3832-28-0x0000000002590000-0x0000000002591000-memory.dmp
memory/3832-29-0x0000000002580000-0x0000000002581000-memory.dmp
memory/3832-30-0x00000000016D0000-0x00000000016D1000-memory.dmp
memory/3832-24-0x0000000001400000-0x0000000001454000-memory.dmp
memory/3832-36-0x0000000000400000-0x000000000051C000-memory.dmp
memory/3832-37-0x0000000001400000-0x0000000001454000-memory.dmp
memory/3832-38-0x00000000016D0000-0x00000000016D1000-memory.dmp