4ef7e23ae13543d794cbf2931fa78cf7bbf7d9c73d953f615570543c9ba1f656

Analysis

max time kernel
146s
max time network
147s
platform
windows7_x64
resource
win7-20231129-en
resource tags

arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system
submitted
10/01/2024, 20:04

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

517bc996ca1bd0a4069e109cff1c9bcf.exe
Size

227KB
MD5

517bc996ca1bd0a4069e109cff1c9bcf
SHA1

334e849653632905a71c7afdfc7f1e2b3f27cc44
SHA256

4ef7e23ae13543d794cbf2931fa78cf7bbf7d9c73d953f615570543c9ba1f656
SHA512

e4665b0a1391c634a92f2c2b4eee2cbffc59027796147cafd573b63a0b10cbf31928485540c9853b9bc271044d376ddd159ae1a86da1becef4121d0c78eda75d
SSDEEP

3072:P8xW7VTCsVmuz+Ydh7f/+fmItroNaCKMz5LEK0sdf:HNH1znJfGfptrqg3y

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
3052	explorer.exe

Executes dropped EXE 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3040 set thread context of 3052	3040	517bc996ca1bd0a4069e109cff1c9bcf.exe	28

Modifies registry class 3 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a873d410-6fd3-1b1c-08a3-ea6185436e1c}\cid = "8791741710861670466"	explorer.exe
Key created	\registry\machine\Software\Classes\Interface\{a873d410-6fd3-1b1c-08a3-ea6185436e1c}	explorer.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Classes\Interface\{a873d410-6fd3-1b1c-08a3-ea6185436e1c}\u = "71"	explorer.exe

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
3052	explorer.exe
3052	explorer.exe
3052	explorer.exe

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	3052	explorer.exe

Suspicious use of UnmapMainImage 1 IoCs

pid	Process
336	csrss.exe

Suspicious use of WriteProcessMemory 10 IoCs

description	pid	Process	procid_target
PID 3040 wrote to memory of 3052	3040	517bc996ca1bd0a4069e109cff1c9bcf.exe	28
PID 3040 wrote to memory of 3052	3040	517bc996ca1bd0a4069e109cff1c9bcf.exe	28
PID 3040 wrote to memory of 3052	3040	517bc996ca1bd0a4069e109cff1c9bcf.exe	28
PID 3040 wrote to memory of 3052	3040	517bc996ca1bd0a4069e109cff1c9bcf.exe	28
PID 3040 wrote to memory of 3052	3040	517bc996ca1bd0a4069e109cff1c9bcf.exe	28
PID 3052 wrote to memory of 336	3052	explorer.exe	26
PID 336 wrote to memory of 2152	336	csrss.exe	29
PID 336 wrote to memory of 2152	336	csrss.exe	29
PID 336 wrote to memory of 2520	336	csrss.exe	30
PID 336 wrote to memory of 2520	336	csrss.exe	30

C:\Users\Admin\AppData\Local\Temp\517bc996ca1bd0a4069e109cff1c9bcf.exe
"C:\Users\Admin\AppData\Local\Temp\517bc996ca1bd0a4069e109cff1c9bcf.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:3040
- C:\Windows\explorer.exe
  00000098*
  2⤵
  - Deletes itself
  - Modifies registry class
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:3052

C:\Windows\system32\csrss.exe
%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
1⤵
- Executes dropped EXE
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:336

C:\Windows\system32\wbem\WMIADAP.EXE
wmiadap.exe /F /T /R
1⤵
PID:2152

C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\system32\wbem\wmiprvse.exe -Embedding
1⤵
PID:2520

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

\Windows\System32\consrv.dll

Filesize
31KB

MD5
adf1ddd89d424e8d0e275cc42747ec81

SHA1
321105503846b4a5f8fd3ccd6d92253c39b3e1ce

SHA256
5611fddc5046fce5bbd4d1c1779df429a217b1f952ec973059f7c67e4dfdd46f

SHA512
3afb78bc1e49c224726ae824a4d36923bc9fedbdbc027576427932d900bbb17a3b536f1b384bc52bd1a1892ff23c5a2453065530fbdc0023392a0d17e7cbc184

Download Submit
\systemroot\assembly\tmp\{1B372133-BFFA-4dba-9CCF-5474BED6A9F6}

Filesize
2KB

MD5
df1d68bc6c846d61d68cdb9aaedd8d8d

SHA1
5f20e8289fe0cded0f6190949eaa80dffa966a86

SHA256
09ffd52133987c05a71e58472ef0ea5216d54585bfb59d32ce843856b27af621

SHA512
dc81b752ba38b38b4bc7d2ad3b288647ea79767cfea115601041f80abfc5da714a6e024e34d381aa345c3b56760de92a44c3db19f425a126abb9feb93113b859

Download Submit
memory/336-19-0x0000000002380000-0x000000000238C000-memory.dmp

Filesize
48KB

Download
memory/336-20-0x0000000002380000-0x000000000238C000-memory.dmp

Filesize
48KB

Download
memory/3040-0-0x0000000000360000-0x0000000000385000-memory.dmp

Filesize
148KB

Download
memory/3040-3-0x0000000000490000-0x0000000000514000-memory.dmp

Filesize
528KB

Download
memory/3040-5-0x0000000000400000-0x0000000000483000-memory.dmp

Filesize
524KB

Download
memory/3052-2-0x0000000000060000-0x0000000000072000-memory.dmp

Filesize
72KB

Download
memory/3052-1-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download
memory/3052-9-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download
memory/3052-14-0x00000000001F0000-0x0000000000204000-memory.dmp

Filesize
80KB

Download