Analysis
-
max time kernel
161s -
max time network
174s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
06/01/2024, 10:41
Behavioral task
behavioral1
Sample
9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe
Resource
win7-20231129-en
General
-
Target
9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe
-
Size
203KB
-
MD5
9e7de6d79ccc935fa7c1b629155ca2ef
-
SHA1
09e1a1d16d81e0c7213cd2664bc47e5ce69165ed
-
SHA256
52bed4d9c0fdb81bdc4abfd46b47b8f8fa2dcdd570fcdc94f300f087c8b3aa65
-
SHA512
58f320b34ee14c21fb69e25afab572a3c91d8f78817c365b49d35b969d5b95cf4298d34a9a437b7e2d1f3113ecdad13d63e05dbfbe50925b3c780e69664d7853
-
SSDEEP
6144:sLV6Bta6dtJmakIM5qDr7rb2Wdkytz9spP:sLV6Btpmk7mWltY
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\DHCP Service = "C:\\Program Files (x86)\\DHCP Service\\dhcpsvc.exe" 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files (x86)\DHCP Service\dhcpsvc.exe 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe File opened for modification C:\Program Files (x86)\DHCP Service\dhcpsvc.exe 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3020 schtasks.exe 2948 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
pid Process 2080 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe 2080 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe 2080 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2080 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2080 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2080 wrote to memory of 3020 2080 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe 102 PID 2080 wrote to memory of 3020 2080 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe 102 PID 2080 wrote to memory of 3020 2080 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe 102 PID 2080 wrote to memory of 2948 2080 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe 105 PID 2080 wrote to memory of 2948 2080 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe 105 PID 2080 wrote to memory of 2948 2080 9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe 105
Processes
-
C:\Users\Admin\AppData\Local\Temp\9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe"C:\Users\Admin\AppData\Local\Temp\9E7DE6D79CCC935FA7C1B629155CA2EFexe.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2080 -
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmp78D0.tmp"2⤵
- Creates scheduled task(s)
PID:3020
-
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "DHCP Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmp96B9.tmp"2⤵
- Creates scheduled task(s)
PID:2948
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1KB
MD57f4b37265a0a4b0fea67999d11d911e8
SHA11b8e13e6a27c3768c30cf713b79eaa8a757e1349
SHA25639b16b3a00b6b43c6820357127228c0768a577153014ce7b0ea3c585244dc08b
SHA512ef97ccfb663555aedc7fdc4b3ac4cd6536c80a778b4ec3bc6124a09544733988de1dac1e6a3714b0d6e8713e3523e0732d5dfcf674f2c5e1f3eadacb0c8e5e03