Analysis
-
max time kernel
117s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
16-01-2024 19:10
Static task
static1
Behavioral task
behavioral1
Sample
60a750362cc45cc0d799ae006dfec30c.exe
Resource
win7-20231215-en
General
-
Target
60a750362cc45cc0d799ae006dfec30c.exe
-
Size
359KB
-
MD5
60a750362cc45cc0d799ae006dfec30c
-
SHA1
97a584c92e07ff506148e331f98cf2ed3983a276
-
SHA256
5670ca915b7269fcdfe6cbcd67f9369911421486b44d6a22b5682cd3267b89b8
-
SHA512
2a222d4b921e399bf4032f989807ca03d1b888c558c707ba7b181b32362facc9ae72dff7beff76afb5f87988471671b17715d33b6a7b8efc9a34441666777a9c
-
SSDEEP
6144:aPS46wHhEYoBu+oW/hCUTSjubgvrNHwsAC3fiifEg8bT3tlRvEw98YUbihID:aPSyBEY5QAvrNHNt3q058/t/JhID
Malware Config
Signatures
-
Ardamax main executable 1 IoCs
Processes:
resource yara_rule \Windows\SysWOW64\Sys\Iexplore.exe family_ardamax -
Executes dropped EXE 2 IoCs
Processes:
60a750362cc45cc0d799ae006dfec30c.TMP0Iexplore.exepid process 3036 60a750362cc45cc0d799ae006dfec30c.TMP0 2724 Iexplore.exe -
Loads dropped DLL 9 IoCs
Processes:
60a750362cc45cc0d799ae006dfec30c.exe60a750362cc45cc0d799ae006dfec30c.TMP0Iexplore.exepid process 2976 60a750362cc45cc0d799ae006dfec30c.exe 2976 60a750362cc45cc0d799ae006dfec30c.exe 2976 60a750362cc45cc0d799ae006dfec30c.exe 3036 60a750362cc45cc0d799ae006dfec30c.TMP0 3036 60a750362cc45cc0d799ae006dfec30c.TMP0 3036 60a750362cc45cc0d799ae006dfec30c.TMP0 2724 Iexplore.exe 2724 Iexplore.exe 2976 60a750362cc45cc0d799ae006dfec30c.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in System32 directory 5 IoCs
Processes:
60a750362cc45cc0d799ae006dfec30c.TMP0Iexplore.exedescription ioc process File created C:\Windows\SysWOW64\Sys\Iexplore.007 60a750362cc45cc0d799ae006dfec30c.TMP0 File created C:\Windows\SysWOW64\Sys\Iexplore.exe 60a750362cc45cc0d799ae006dfec30c.TMP0 File opened for modification C:\Windows\SysWOW64\Sys Iexplore.exe File created C:\Windows\SysWOW64\Sys\Iexplore.001 60a750362cc45cc0d799ae006dfec30c.TMP0 File created C:\Windows\SysWOW64\Sys\Iexplore.006 60a750362cc45cc0d799ae006dfec30c.TMP0 -
Suspicious use of SetThreadContext 1 IoCs
Processes:
60a750362cc45cc0d799ae006dfec30c.exedescription pid process target process PID 2976 set thread context of 3036 2976 60a750362cc45cc0d799ae006dfec30c.exe 60a750362cc45cc0d799ae006dfec30c.TMP0 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Modifies registry class 4 IoCs
Processes:
60a750362cc45cc0d799ae006dfec30c.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID 60a750362cc45cc0d799ae006dfec30c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60542247-0249-417D-949B-2F0CC7EE1165} 60a750362cc45cc0d799ae006dfec30c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node 60a750362cc45cc0d799ae006dfec30c.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{60632754-c523-4b62-b45c-4172da012619} 60a750362cc45cc0d799ae006dfec30c.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
Iexplore.exedescription pid process Token: 33 2724 Iexplore.exe Token: SeIncBasePriorityPrivilege 2724 Iexplore.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
Iexplore.exepid process 2724 Iexplore.exe 2724 Iexplore.exe 2724 Iexplore.exe 2724 Iexplore.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
60a750362cc45cc0d799ae006dfec30c.exe60a750362cc45cc0d799ae006dfec30c.TMP0description pid process target process PID 2976 wrote to memory of 3036 2976 60a750362cc45cc0d799ae006dfec30c.exe 60a750362cc45cc0d799ae006dfec30c.TMP0 PID 2976 wrote to memory of 3036 2976 60a750362cc45cc0d799ae006dfec30c.exe 60a750362cc45cc0d799ae006dfec30c.TMP0 PID 2976 wrote to memory of 3036 2976 60a750362cc45cc0d799ae006dfec30c.exe 60a750362cc45cc0d799ae006dfec30c.TMP0 PID 2976 wrote to memory of 3036 2976 60a750362cc45cc0d799ae006dfec30c.exe 60a750362cc45cc0d799ae006dfec30c.TMP0 PID 2976 wrote to memory of 3036 2976 60a750362cc45cc0d799ae006dfec30c.exe 60a750362cc45cc0d799ae006dfec30c.TMP0 PID 2976 wrote to memory of 3036 2976 60a750362cc45cc0d799ae006dfec30c.exe 60a750362cc45cc0d799ae006dfec30c.TMP0 PID 3036 wrote to memory of 2724 3036 60a750362cc45cc0d799ae006dfec30c.TMP0 Iexplore.exe PID 3036 wrote to memory of 2724 3036 60a750362cc45cc0d799ae006dfec30c.TMP0 Iexplore.exe PID 3036 wrote to memory of 2724 3036 60a750362cc45cc0d799ae006dfec30c.TMP0 Iexplore.exe PID 3036 wrote to memory of 2724 3036 60a750362cc45cc0d799ae006dfec30c.TMP0 Iexplore.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\60a750362cc45cc0d799ae006dfec30c.exe"C:\Users\Admin\AppData\Local\Temp\60a750362cc45cc0d799ae006dfec30c.exe"1⤵
- Loads dropped DLL
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:2976 -
C:\Users\Admin\AppData\Local\Temp\60a750362cc45cc0d799ae006dfec30c.TMP0"C:\Users\Admin\AppData\Local\Temp\60a750362cc45cc0d799ae006dfec30c.exe"2⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:3036 -
C:\Windows\SysWOW64\Sys\Iexplore.exe"C:\Windows\system32\Sys\Iexplore.exe"3⤵
- Executes dropped EXE
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2724
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
3KB
MD5bdb0f21d4546c81767aac5d89b961feb
SHA1ffe544f6060e8b1bf6e6209583826c0280ec550c
SHA256e67c7bc6d66cb09ad483204bac53dab088a1df21b9d658525402180e4611b7f4
SHA512e15d7035304725e928556e158ff33487b4d72adf410d2725d56b2529b47e801c303bf53ae75d6ac098a3f1f2b7c6e1d701d13d2fff3f99e8ba4b5f7a0e8a912e
-
Filesize
5KB
MD5ff2bc313174a6ccfe1e0b5b1a58f0f49
SHA14e983cdee788faf6a13a9d5bf3f00f4a17dd6e8e
SHA256f212c83897599d81f4010f1ef3a43e5709e874912072d38d26a5ef5644462318
SHA512418083066ba5505267f4de91c9e439674e02645c430360dae22dfc390c33b4e0c01857634d1dcb5dc298c296a5f4130397388bceee2ad82ba0a711ab56d1bd0f
-
Filesize
4KB
MD550c8c542dca77df82f5925b145567611
SHA164bdce386146e3548d3d85cf16fdd0d34cbafe2f
SHA2560692f76ec589e517f0a5205e658ca44656322c0382cee2af53890324818b3e0f
SHA512f7df5e9ac0c81f832e8dfe882eb1c4746f30131bef5a56947634146c813df079acd57b3fc954254684c6f4ef291802cd9629e6af3ced9be1f381fdd858a327c2
-
Filesize
267KB
MD534ab6e2ee19b3185a541fa1b16565852
SHA18ca0d8ba8f88415d2528f853b4de23331a7a6c2f
SHA256a3fa3620830d33e00542aef51f4de03ae9f8556e1c4c9406a89707255f96b8a1
SHA51294b6ab542030978a9e6f8bbd7d4392a27175704bf60b7048878b4a55d965479ea08e54fcf464fad3d98724f9d4eeecb061c80d787b9600544cf4674cada0e93a
-
Filesize
4KB
MD5a9680f653434b4766fdc2a3c592af879
SHA1fd8e999c43fa83df3144aa5bbaae73bac3834296
SHA25630e084f531980a35b79dd36ac9ee0022d0aba792da99b3d71eea26d327db9ad3
SHA512685fe7bbaf9fe5d140f07e9fe0f1eff0cecf8a3a4d050fe917ce8eddac3394ab7b8cea575e2d6f3dace309716662fbb5a9016850b120ea2099a00cfc848f57ac
-
Filesize
64KB
MD5e99a5f2bf65521137b0276146c2b493a
SHA18668f6adc2613bcd8b1403779a707466d4cc6174
SHA256c000978738a9c544fd3d2689bc8017dd42fdbf9428ae9183c8742baf34dd96c4
SHA512ddbbc88546f522f3d99f296ac4fb1fdd72e7f6604081ab17f0f16e065f69db01dd2f7b7d249904737d386db6006123dde2965234e36a497cd48394d13b4e758f
-
Filesize
459KB
MD54db1b69341dc88b901d85be34278a634
SHA10d55d2852a58b597c96c1dcec25efc961d882ba1
SHA256c3f29e3f8b9eb7c20a0046fc105d2199dc5327a570e8c76908e44be1200fb893
SHA512e11ee43c65179a562254cc63fda5c25ae228603bd88fd357faea2a5b49b4df11dfde5efe46544ac138d008cdffc419c793b35781ef201a9462a9eda30b52dee0