Analysis
-
max time kernel
133s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
06-01-2024 12:28
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
463a8a60f35a3ae92b999f066a5faf61.exe
Resource
win7-20231215-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
463a8a60f35a3ae92b999f066a5faf61.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
463a8a60f35a3ae92b999f066a5faf61.exe
-
Size
38KB
-
MD5
463a8a60f35a3ae92b999f066a5faf61
-
SHA1
cb8bf11402b1f54b4a536ec8582dd82480563432
-
SHA256
5ff755dd230831c715301dd58ab12ba387d24bfc3e4b992576540fe27b7d1740
-
SHA512
8017415bad875987cd5a2f2747bdccf489f03b18a259518268491acf057de6babdafbc12f198b02f44fd05ee0c0c318a34c3d5c7962f129dd6c3d0f2f7a7e354
-
SSDEEP
768:OX2Up00Eya6faWD2U+cZBYPNt5y6r3saUBm4NpVs7NQX8EZAfbxm:ep00Ep6fGyBYFzy6r3KpVcC8t
Score
8/10
Malware Config
Signatures
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
pid Process 2124 cmd.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum 463a8a60f35a3ae92b999f066a5faf61.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 463a8a60f35a3ae92b999f066a5faf61.exe -
Drops file in Windows directory 7 IoCs
description ioc Process File opened for modification C:\Windows\Logs\DPX\setupact.log wusa.exe File opened for modification C:\Windows\Logs\DPX\setuperr.log wusa.exe File opened for modification C:\Windows\$dpx$.tmp wusa.exe File created C:\Windows\$dpx$.tmp\4c674ebea6068640b93b2e0257514dab.tmp wusa.exe File opened for modification C:\Windows\linkinfo.dll wusa.exe File opened for modification C:\Windows\$dpx$.tmp\job.xml wusa.exe File created C:\Windows\wusa.lock wusa.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Kills process with taskkill 1 IoCs
pid Process 2720 taskkill.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-1268429524-3929314613-1992311491-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2656 explorer.exe -
Suspicious use of AdjustPrivilegeToken 13 IoCs
description pid Process Token: SeDebugPrivilege 2720 taskkill.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe Token: SeShutdownPrivilege 2656 explorer.exe -
Suspicious use of FindShellTrayWindow 30 IoCs
pid Process 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe -
Suspicious use of SendNotifyMessage 24 IoCs
pid Process 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe 2656 explorer.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2188 wrote to memory of 1168 2188 463a8a60f35a3ae92b999f066a5faf61.exe 28 PID 2188 wrote to memory of 1168 2188 463a8a60f35a3ae92b999f066a5faf61.exe 28 PID 2188 wrote to memory of 1168 2188 463a8a60f35a3ae92b999f066a5faf61.exe 28 PID 2188 wrote to memory of 1168 2188 463a8a60f35a3ae92b999f066a5faf61.exe 28 PID 2188 wrote to memory of 2740 2188 463a8a60f35a3ae92b999f066a5faf61.exe 30 PID 2188 wrote to memory of 2740 2188 463a8a60f35a3ae92b999f066a5faf61.exe 30 PID 2188 wrote to memory of 2740 2188 463a8a60f35a3ae92b999f066a5faf61.exe 30 PID 2188 wrote to memory of 2740 2188 463a8a60f35a3ae92b999f066a5faf61.exe 30 PID 2188 wrote to memory of 2740 2188 463a8a60f35a3ae92b999f066a5faf61.exe 30 PID 2188 wrote to memory of 2740 2188 463a8a60f35a3ae92b999f066a5faf61.exe 30 PID 2188 wrote to memory of 2740 2188 463a8a60f35a3ae92b999f066a5faf61.exe 30 PID 2188 wrote to memory of 2720 2188 463a8a60f35a3ae92b999f066a5faf61.exe 31 PID 2188 wrote to memory of 2720 2188 463a8a60f35a3ae92b999f066a5faf61.exe 31 PID 2188 wrote to memory of 2720 2188 463a8a60f35a3ae92b999f066a5faf61.exe 31 PID 2188 wrote to memory of 2720 2188 463a8a60f35a3ae92b999f066a5faf61.exe 31 PID 2188 wrote to memory of 2656 2188 463a8a60f35a3ae92b999f066a5faf61.exe 34 PID 2188 wrote to memory of 2656 2188 463a8a60f35a3ae92b999f066a5faf61.exe 34 PID 2188 wrote to memory of 2656 2188 463a8a60f35a3ae92b999f066a5faf61.exe 34 PID 2188 wrote to memory of 2656 2188 463a8a60f35a3ae92b999f066a5faf61.exe 34 PID 2188 wrote to memory of 2124 2188 463a8a60f35a3ae92b999f066a5faf61.exe 36 PID 2188 wrote to memory of 2124 2188 463a8a60f35a3ae92b999f066a5faf61.exe 36 PID 2188 wrote to memory of 2124 2188 463a8a60f35a3ae92b999f066a5faf61.exe 36 PID 2188 wrote to memory of 2124 2188 463a8a60f35a3ae92b999f066a5faf61.exe 36 -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\463a8a60f35a3ae92b999f066a5faf61.exe"C:\Users\Admin\AppData\Local\Temp\463a8a60f35a3ae92b999f066a5faf61.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\makecab.exe"C:\Windows\System32\makecab.exe" C:\Users\Admin\AppData\Local\Temp\linkinfo.dll C:\Users\Admin\AppData\Local\Temp\98E5.tmp.cab2⤵PID:1168
-
-
C:\Windows\SysWOW64\wusa.exe"C:\Windows\system32\wusa.exe" /quiet C:\Users\Admin\AppData\Local\Temp\98E5.tmp.cab /extract:C:\Windows\2⤵
- Drops file in Windows directory
PID:2740
-
-
C:\Windows\SysWOW64\taskkill.exe"C:\Windows\System32\taskkill.exe" /f /im explorer.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2720
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2656
-
-
C:\Windows\SysWOW64\cmd.execmd /c C:\Users\Admin\AppData\Local\Temp\A0A4.tmp.bat2⤵
- Deletes itself
PID:2124
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
236B
MD5cd852f7d9c65639392b1263a5eebff2c
SHA1ea65163ac438b99d20b715e7b1a04e1388a259d3
SHA25691f541d51f42368685b6ffccee0cbb5be0bf8fa1303449d240526ffb77948195
SHA5129ce4b005c2ca984e7e7a0a21af7614e21c3e5f38441e2eca8f75aa22b86cf2563d981b7e5f747655239dda38212138a883a1524d22610af2b6b99c37ea0a28ce
-
Filesize
24KB
MD5e2a7d8d7b1643a055fc769b40ede3dfe
SHA12c33f68f45bae3639feb2103df4a3c8cfaa330f3
SHA256e24b1a9eba2320df5919cf11aacc5bc7c0b353f47fe0e9172f3617cee52933c9
SHA5126944f9d65b457c45f825375825e424d6e667dfcf352c1fdf2f192f4752f9ef3179c0dd3b639925e59e85e80bc379f238a5941b9fb460ab42ed7379e710afa44a