Analysis
-
max time kernel
2s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
07-01-2024 03:40
Behavioral task
behavioral1
Sample
47ee5ee8fb0aae147f02f6147be5c1bf.exe
Resource
win7-20231215-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
47ee5ee8fb0aae147f02f6147be5c1bf.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
47ee5ee8fb0aae147f02f6147be5c1bf.exe
-
Size
102KB
-
MD5
47ee5ee8fb0aae147f02f6147be5c1bf
-
SHA1
99114aad9480cb1332219c63c9b74f3566eb9c06
-
SHA256
ed7d92fccfade45aef7c37d4cfe3c9999d972d686909b691af223faf6be0d4ca
-
SHA512
db0942f09b1bf06a5f6ae126ea909145b29e55f978ec55b2eb484a72a823080f07ab2bde76a67cbdb71abf94c9d006e72c8f8dde19778f931f488f0a99557d8e
-
SSDEEP
3072:7y3Mq4GSDrFNttUwqwp1lsg2I4eVhXgRlso:7QMqEbT5rJ2I4Rzx
Score
8/10
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\knownsvr.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravmond.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psctrls.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccregvfy.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kasmain.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvcui.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\webproxy.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsmain.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\xcommsvr.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\knownsvr.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctskshd.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccevtmgr.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp32.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsshld.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mctskshd.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ast.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcvsescn.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avtask.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvsrvxp.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kissvc.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vstskmgr.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvprescan.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvol.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccapp.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safebank.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psctrls.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\smartup.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\symlcsvc.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rsmain.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avgnt.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ccenter.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvprescan.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vcr32.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\uihost.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kregex.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\makereport.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kaccore.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvxp.kxp\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avcenter.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\updaterui.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\seccenter.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwproxy.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\vptray.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvwsc.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kaccore.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\psimsvc.exe\Debugger = "ntsd -d" 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rssafety.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avguard.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360hotfix.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\agentsvr.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvmonxp.kxp 47ee5ee8fb0aae147f02f6147be5c1bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\bdagent.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe -
resource yara_rule behavioral1/memory/2508-3-0x0000000000400000-0x0000000000446000-memory.dmp upx behavioral1/memory/2508-16-0x0000000000400000-0x0000000000446000-memory.dmp upx -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\java\classes\clrescfgon.exe 47ee5ee8fb0aae147f02f6147be5c1bf.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\HTTP\shell\open\command\vvname = "m}su}rgwa\x7f/uvt" 47ee5ee8fb0aae147f02f6147be5c1bf.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe -
Suspicious behavior: LoadsDriver 1 IoCs
pid Process 476 Process not Found -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe Token: SeDebugPrivilege 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2508 wrote to memory of 2672 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 28 PID 2508 wrote to memory of 2672 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 28 PID 2508 wrote to memory of 2672 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 28 PID 2508 wrote to memory of 2672 2508 47ee5ee8fb0aae147f02f6147be5c1bf.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\47ee5ee8fb0aae147f02f6147be5c1bf.exe"C:\Users\Admin\AppData\Local\Temp\47ee5ee8fb0aae147f02f6147be5c1bf.exe"1⤵
- Sets file execution options in registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2508 -
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe" http://s31.cnzz.com/stat.php?id=1215051&web_id=12150512⤵PID:2672
-
C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE"C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:2672 CREDAT:275457 /prefetch:23⤵PID:2692
-
-