0d01615bbf5aa5f8c41b54fa1dfe8a68d62f5406ebf9f3089241c0de7a1cc46c

Analysis

max time kernel
6s
max time network
9s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
14-01-2024 14:28

Sharing

Copy URL

Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

5b797902a4913eaad0823b4dd6fa00dc.exe
Size

85KB
MD5

5b797902a4913eaad0823b4dd6fa00dc
SHA1

708a35a56ec6016483fae03e01a037d5eea4860c
SHA256

0d01615bbf5aa5f8c41b54fa1dfe8a68d62f5406ebf9f3089241c0de7a1cc46c
SHA512

65dd609058c88b315be152a0242c2b841084e6b0e405299807b26b4922ee6633d9c96038a2d24c5d4bbac72975f96096545d1bd1dbc9c41c9fdd48c80af18bad
SSDEEP

1536:X2KMyXugR92nkWMvkj4jP2TlEdEHxrcHrZSOx442BMMuYU6QKWAYS:zRXHFPvkciQfLDgXhYS

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2376	cmd.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\902017358 = "C:\\Users\\Admin\\902017358.exe"	reg.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeIncBasePriorityPrivilege	3020	5b797902a4913eaad0823b4dd6fa00dc.exe
Token: SeShutdownPrivilege	1324	shutdown.exe
Token: SeRemoteShutdownPrivilege	1324	shutdown.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 3020 wrote to memory of 2172	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	28
PID 3020 wrote to memory of 2172	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	28
PID 3020 wrote to memory of 2172	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	28
PID 3020 wrote to memory of 2172	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	28
PID 2172 wrote to memory of 3036	2172	cmd.exe	30
PID 2172 wrote to memory of 3036	2172	cmd.exe	30
PID 2172 wrote to memory of 3036	2172	cmd.exe	30
PID 2172 wrote to memory of 3036	2172	cmd.exe	30
PID 3020 wrote to memory of 1324	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	31
PID 3020 wrote to memory of 1324	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	31
PID 3020 wrote to memory of 1324	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	31
PID 3020 wrote to memory of 1324	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	31
PID 3020 wrote to memory of 2376	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	33
PID 3020 wrote to memory of 2376	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	33
PID 3020 wrote to memory of 2376	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	33
PID 3020 wrote to memory of 2376	3020	5b797902a4913eaad0823b4dd6fa00dc.exe	33

C:\Users\Admin\AppData\Local\Temp\5b797902a4913eaad0823b4dd6fa00dc.exe
"C:\Users\Admin\AppData\Local\Temp\5b797902a4913eaad0823b4dd6fa00dc.exe"
1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3020
- C:\Windows\SysWOW64\cmd.exe
  cmd.exe /c REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 902017358 /t REG_SZ /d "%userprofile%\902017358.exe" /f
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:2172
- - C:\Windows\SysWOW64\reg.exe
    REG ADD HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run /v 902017358 /t REG_SZ /d "C:\Users\Admin\902017358.exe" /f
    3⤵
    - Adds Run key to start application
    PID:3036
- C:\Windows\SysWOW64\shutdown.exe
  "C:\Windows\System32\shutdown.exe" /r /f /t 3
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:1324
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\system32\cmd.exe" /c del C:\Users\Admin\AppData\Local\Temp\5B7979~1.EXE > nul
  2⤵
  - Deletes itself
  PID:2376

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x0
1⤵
PID:2880

C:\Windows\system32\LogonUI.exe
"LogonUI.exe" /flags:0x1
1⤵
PID:2728

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2728-6-0x0000000002B30000-0x0000000002B31000-memory.dmp

Filesize
4KB

Download
memory/2880-5-0x0000000002E10000-0x0000000002E11000-memory.dmp

Filesize
4KB

Download
memory/3020-2-0x0000000000240000-0x0000000000247000-memory.dmp

Filesize
28KB

Download
memory/3020-0-0x0000000000230000-0x000000000023E000-memory.dmp

Filesize
56KB

Download
memory/3020-3-0x00000000013C0000-0x00000000013E3000-memory.dmp

Filesize
140KB

Download

Analysis

Sharing

Errors

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads