Analysis
-
max time kernel
118s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
12/01/2024, 13:23
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
56943455c19500c0460dfd3888cbdb06.exe
Resource
win7-20231215-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
56943455c19500c0460dfd3888cbdb06.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
56943455c19500c0460dfd3888cbdb06.exe
-
Size
21KB
-
MD5
56943455c19500c0460dfd3888cbdb06
-
SHA1
8ca4bda04177a90c83418b65fb92b6dfa885afbc
-
SHA256
0a0c74cb26c4eeee4b5fe3779952282cc60b91a4adc1199335c3a55a7a15136d
-
SHA512
26891d6c3870f5bdc5f431b7c39fba83a5df8c3dd0012dc31d961264408e18dd10e286849b45be983b5b9df9bd2391105fad31299021b838a40c6f75334e697c
-
SSDEEP
384:TS6R8TvoUY3F+qO45Vt1nOU6RIJaIYKgnvpCn71Zv1RF98pYMr2OqmPj52E:TSCCvBr85VnOU6yJpYRwnF9bo2jE
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2760 cmd.exe -
Loads dropped DLL 1 IoCs
pid Process 1736 56943455c19500c0460dfd3888cbdb06.exe -
Drops file in System32 directory 3 IoCs
description ioc Process File created C:\Windows\SysWOW64\6457aed.drv 56943455c19500c0460dfd3888cbdb06.exe File opened for modification C:\Windows\SysWOW64\950D1600.cfg 56943455c19500c0460dfd3888cbdb06.exe File opened for modification C:\Windows\SysWOW64\950D1600.dll 56943455c19500c0460dfd3888cbdb06.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 7 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 56943455c19500c0460dfd3888cbdb06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID 56943455c19500c0460dfd3888cbdb06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{950D1600-DE4A-448D-93B4-7BAE5A7A8052} 56943455c19500c0460dfd3888cbdb06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{950D1600-DE4A-448D-93B4-7BAE5A7A8052}\InprocServer32 56943455c19500c0460dfd3888cbdb06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{950D1600-DE4A-448D-93B4-7BAE5A7A8052}\InprocServer32\ = "950D1600.dll" 56943455c19500c0460dfd3888cbdb06.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{950D1600-DE4A-448D-93B4-7BAE5A7A8052}\InprocServer32\ThreadingModel = "Apartment" 56943455c19500c0460dfd3888cbdb06.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLsID\{950D1600-DE4A-448D-93B4-7BAE5A7A8052}\InprocServer32 56943455c19500c0460dfd3888cbdb06.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1736 56943455c19500c0460dfd3888cbdb06.exe 1736 56943455c19500c0460dfd3888cbdb06.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 468 Process not Found 468 Process not Found -
Suspicious use of AdjustPrivilegeToken 55 IoCs
description pid Process Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe Token: SeDebugPrivilege 1736 56943455c19500c0460dfd3888cbdb06.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1736 56943455c19500c0460dfd3888cbdb06.exe 1736 56943455c19500c0460dfd3888cbdb06.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1736 56943455c19500c0460dfd3888cbdb06.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1736 wrote to memory of 2760 1736 56943455c19500c0460dfd3888cbdb06.exe 28 PID 1736 wrote to memory of 2760 1736 56943455c19500c0460dfd3888cbdb06.exe 28 PID 1736 wrote to memory of 2760 1736 56943455c19500c0460dfd3888cbdb06.exe 28 PID 1736 wrote to memory of 2760 1736 56943455c19500c0460dfd3888cbdb06.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\56943455c19500c0460dfd3888cbdb06.exe"C:\Users\Admin\AppData\Local\Temp\56943455c19500c0460dfd3888cbdb06.exe"1⤵
- Loads dropped DLL
- Drops file in System32 directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1736 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\569434~1.EXE >> NUL2⤵
- Deletes itself
PID:2760
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
211KB
MD5fb96ca2824c78fb0aa7fbbdde02e01cd
SHA12bb4c534c0eb0155186c7601bbde14d83704c517
SHA25611ceca5d16f948a6534a4353d38361eb55628ee56c246bb455773b737dee2da8
SHA51294604d4f541fbd2845ef0332137d252bee02a8f4f14dd31b1d6d2b3e3ebc9c9a6aa61f7b5205c5c40b97439c3fea7ca9e5e7ae7892609cbf4ecaeee0a2ee8a7f