Analysis
-
max time kernel
184s -
max time network
203s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
10-01-2024 09:01
Static task
static1
Behavioral task
behavioral1
Sample
5025d4d18be3e307f280ce99792bd103.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
5025d4d18be3e307f280ce99792bd103.exe
Resource
win10v2004-20231215-en
General
-
Target
5025d4d18be3e307f280ce99792bd103.exe
-
Size
386KB
-
MD5
5025d4d18be3e307f280ce99792bd103
-
SHA1
1ebf08dae68919dcec39b056eee1d84051db0cdf
-
SHA256
ff658f2385cd1ea6958f1abac9f1af4460ec66764f8373f43f7146f605dc1ae7
-
SHA512
f1d0700bee5933cb6bd1a2744a9ae7f98c099a5ed63531cc210d5565045f45b74431e64f7e7b0a961385158c17977f5c00c975466ce7fea2b833047987957695
-
SSDEEP
6144:PCHDNhB0WCqB7l+04YmQ71poL5Cgg2GaSppsBUdZeppRSA6G7F3tNyu:qHZhW4BxXmQ71pkCg2aSoaISAxPL
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
lB15402GgEfE15402.exepid process 680 lB15402GgEfE15402.exe -
Loads dropped DLL 2 IoCs
Processes:
5025d4d18be3e307f280ce99792bd103.exepid process 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe -
Processes:
resource yara_rule behavioral1/memory/2124-1-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/680-87-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/2124-163-0x0000000000400000-0x00000000004CF000-memory.dmp upx behavioral1/memory/680-166-0x0000000000400000-0x00000000004CF000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
lB15402GgEfE15402.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\lB15402GgEfE15402 = "C:\\ProgramData\\lB15402GgEfE15402\\lB15402GgEfE15402.exe" lB15402GgEfE15402.exe -
Processes:
lB15402GgEfE15402.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3308111660-3636268597-2291490419-1000\Software\Microsoft\Internet Explorer\Main lB15402GgEfE15402.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
5025d4d18be3e307f280ce99792bd103.exepid process 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe 2124 5025d4d18be3e307f280ce99792bd103.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
5025d4d18be3e307f280ce99792bd103.exelB15402GgEfE15402.exedescription pid process Token: SeDebugPrivilege 2124 5025d4d18be3e307f280ce99792bd103.exe Token: SeDebugPrivilege 680 lB15402GgEfE15402.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
lB15402GgEfE15402.exepid process 680 lB15402GgEfE15402.exe 680 lB15402GgEfE15402.exe 680 lB15402GgEfE15402.exe 680 lB15402GgEfE15402.exe 680 lB15402GgEfE15402.exe -
Suspicious use of SendNotifyMessage 5 IoCs
Processes:
lB15402GgEfE15402.exepid process 680 lB15402GgEfE15402.exe 680 lB15402GgEfE15402.exe 680 lB15402GgEfE15402.exe 680 lB15402GgEfE15402.exe 680 lB15402GgEfE15402.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
lB15402GgEfE15402.exepid process 680 lB15402GgEfE15402.exe 680 lB15402GgEfE15402.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
5025d4d18be3e307f280ce99792bd103.exedescription pid process target process PID 2124 wrote to memory of 680 2124 5025d4d18be3e307f280ce99792bd103.exe lB15402GgEfE15402.exe PID 2124 wrote to memory of 680 2124 5025d4d18be3e307f280ce99792bd103.exe lB15402GgEfE15402.exe PID 2124 wrote to memory of 680 2124 5025d4d18be3e307f280ce99792bd103.exe lB15402GgEfE15402.exe PID 2124 wrote to memory of 680 2124 5025d4d18be3e307f280ce99792bd103.exe lB15402GgEfE15402.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\5025d4d18be3e307f280ce99792bd103.exe"C:\Users\Admin\AppData\Local\Temp\5025d4d18be3e307f280ce99792bd103.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\lB15402GgEfE15402\lB15402GgEfE15402.exe"C:\ProgramData\lB15402GgEfE15402\lB15402GgEfE15402.exe" "C:\Users\Admin\AppData\Local\Temp\5025d4d18be3e307f280ce99792bd103.exe"2⤵
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\lB15402GgEfE15402\lB15402GgEfE15402.exeFilesize
386KB
MD53323fb1d0434b434a39a2eabee52e93b
SHA1e8e3c87bbe3ed4d2bb38ef823f08b87343f64303
SHA256889dc5624df764a8dc115a92e9a8004c17ed34f02eef2ecef47e61399cab0ff7
SHA512d61d2bad744f671a7cc39045cb7d84c6ff9e904abbcca5a818e59cecaef9f831e7f4107165f141fccf1209716394282bd3322385602df505e6e026b96f6ee71e
-
memory/680-87-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/680-88-0x00000000001E0000-0x00000000001E1000-memory.dmpFilesize
4KB
-
memory/680-166-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/2124-0-0x0000000000240000-0x0000000000243000-memory.dmpFilesize
12KB
-
memory/2124-1-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB
-
memory/2124-2-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/2124-163-0x0000000000400000-0x00000000004CF000-memory.dmpFilesize
828KB