Analysis
-
max time kernel
7s -
max time network
7s -
platform
windows7_x64 -
resource
win7-20231129-en -
resource tags
arch:x64arch:x86image:win7-20231129-enlocale:en-usos:windows7-x64system -
submitted
19-01-2024 13:20
Static task
static1
Behavioral task
behavioral1
Sample
67b78d68337844c4ce0c585851b633e2.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
67b78d68337844c4ce0c585851b633e2.exe
Resource
win10v2004-20231222-en
Errors
General
-
Target
67b78d68337844c4ce0c585851b633e2.exe
-
Size
39KB
-
MD5
67b78d68337844c4ce0c585851b633e2
-
SHA1
e356526d53a8f1bef9587544c46af4035d31d7f8
-
SHA256
d1bf365dc4132fb562fb99e01e3613ed2a3548d5af74a810debacb7da8bf4e28
-
SHA512
0b4ce217d00d6f1f76700a15aeae9cbf91a88f3e4ec96806e4f45b04480f19b734151fd74934921d8cf08ea702b49c4f88682df446d8330c6486e9169e8ec0be
-
SSDEEP
384:bZk4nwCxOnBpWP0Gre5dHMvjNk4UIgeOdCAH2N7gt/V5bd2ChRl9mmu1ZPeic:bZhwCepW1re5arXAHr/Lbd2Pmbi
Malware Config
Signatures
-
Disables RegEdit via registry modification 1 IoCs
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\USER\S-1-5-21-3627615824-4061627003-3019543961-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2468 svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
DF0AC804A0483CF409AB.exepid process 3068 DF0AC804A0483CF409AB.exe -
Loads dropped DLL 2 IoCs
Processes:
svchost.exepid process 2468 svchost.exe 2468 svchost.exe -
Drops file in Windows directory 3 IoCs
Processes:
DrvInst.exedescription ioc process File opened for modification C:\Windows\INF\setupapi.ev3 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.ev1 DrvInst.exe File opened for modification C:\Windows\INF\setupapi.dev.log DrvInst.exe -
Modifies data under HKEY_USERS 43 IoCs
Processes:
DrvInst.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\Certificates DrvInst.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Classes\Local Settings\MuiCache\2D\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\TrustedPeople\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\My DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\CA\Certificates DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Disallowed\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\Root\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\SmartCardRoot\CRLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\SystemCertificates\trust\CTLs DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust DrvInst.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Policies\Microsoft\SystemCertificates\CA\CTLs DrvInst.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
Processes:
svchost.exevssvc.exeDrvInst.exeshutdown.exedescription pid process Token: SeSystemProfilePrivilege 2468 svchost.exe Token: SeBackupPrivilege 1932 vssvc.exe Token: SeRestorePrivilege 1932 vssvc.exe Token: SeAuditPrivilege 1932 vssvc.exe Token: SeRestorePrivilege 2548 DrvInst.exe Token: SeRestorePrivilege 2548 DrvInst.exe Token: SeRestorePrivilege 2548 DrvInst.exe Token: SeRestorePrivilege 2548 DrvInst.exe Token: SeRestorePrivilege 2548 DrvInst.exe Token: SeRestorePrivilege 2548 DrvInst.exe Token: SeRestorePrivilege 2548 DrvInst.exe Token: SeLoadDriverPrivilege 2548 DrvInst.exe Token: SeLoadDriverPrivilege 2548 DrvInst.exe Token: SeLoadDriverPrivilege 2548 DrvInst.exe Token: SeShutdownPrivilege 3064 shutdown.exe Token: SeRemoteShutdownPrivilege 3064 shutdown.exe -
Suspicious use of WriteProcessMemory 22 IoCs
Processes:
67b78d68337844c4ce0c585851b633e2.exesvchost.exeDF0AC804A0483CF409AB.exedescription pid process target process PID 2264 wrote to memory of 2468 2264 67b78d68337844c4ce0c585851b633e2.exe svchost.exe PID 2264 wrote to memory of 2468 2264 67b78d68337844c4ce0c585851b633e2.exe svchost.exe PID 2264 wrote to memory of 2468 2264 67b78d68337844c4ce0c585851b633e2.exe svchost.exe PID 2264 wrote to memory of 2468 2264 67b78d68337844c4ce0c585851b633e2.exe svchost.exe PID 2264 wrote to memory of 2468 2264 67b78d68337844c4ce0c585851b633e2.exe svchost.exe PID 2468 wrote to memory of 1840 2468 svchost.exe reg.exe PID 2468 wrote to memory of 1840 2468 svchost.exe reg.exe PID 2468 wrote to memory of 1840 2468 svchost.exe reg.exe PID 2468 wrote to memory of 1840 2468 svchost.exe reg.exe PID 2468 wrote to memory of 3064 2468 svchost.exe shutdown.exe PID 2468 wrote to memory of 3064 2468 svchost.exe shutdown.exe PID 2468 wrote to memory of 3064 2468 svchost.exe shutdown.exe PID 2468 wrote to memory of 3064 2468 svchost.exe shutdown.exe PID 2468 wrote to memory of 3068 2468 svchost.exe DF0AC804A0483CF409AB.exe PID 2468 wrote to memory of 3068 2468 svchost.exe DF0AC804A0483CF409AB.exe PID 2468 wrote to memory of 3068 2468 svchost.exe DF0AC804A0483CF409AB.exe PID 2468 wrote to memory of 3068 2468 svchost.exe DF0AC804A0483CF409AB.exe PID 3068 wrote to memory of 2000 3068 DF0AC804A0483CF409AB.exe svchost.exe PID 3068 wrote to memory of 2000 3068 DF0AC804A0483CF409AB.exe svchost.exe PID 3068 wrote to memory of 2000 3068 DF0AC804A0483CF409AB.exe svchost.exe PID 3068 wrote to memory of 2000 3068 DF0AC804A0483CF409AB.exe svchost.exe PID 3068 wrote to memory of 2000 3068 DF0AC804A0483CF409AB.exe svchost.exe -
Uses Volume Shadow Copy service COM API
The Volume Shadow Copy service is used to manage backups/snapshots.
Processes
-
C:\Users\Admin\AppData\Local\Temp\67b78d68337844c4ce0c585851b633e2.exe"C:\Users\Admin\AppData\Local\Temp\67b78d68337844c4ce0c585851b633e2.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:2264 -
C:\Windows\SysWOW64\svchost.exesvchost.exe2⤵
- Disables RegEdit via registry modification
- Deletes itself
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\SysWOW64\reg.exereg.exe add "HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System"3⤵PID:1840
-
C:\Windows\SysWOW64\shutdown.exeshutdown.exe -r -f -t 03⤵
- Suspicious use of AdjustPrivilegeToken
PID:3064 -
C:\Users\Admin\AppData\Local\Temp\DF0AC804A0483CF409AB.exeC:\Users\Admin\AppData\Local\Temp\DF0AC804A0483CF409AB.exe3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:3068 -
C:\Windows\SysWOW64\svchost.exesvchost.exe4⤵PID:2000
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1932
-
C:\Windows\system32\DrvInst.exeDrvInst.exe "1" "200" "STORAGE\VolumeSnapshot\HarddiskVolumeSnapshot19" "" "" "61530dda3" "0000000000000000" "000000000000005C" "0000000000000570"1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:2548
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:1940
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1444
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\DF0AC804A0483CF409AB.exeFilesize
39KB
MD567b78d68337844c4ce0c585851b633e2
SHA1e356526d53a8f1bef9587544c46af4035d31d7f8
SHA256d1bf365dc4132fb562fb99e01e3613ed2a3548d5af74a810debacb7da8bf4e28
SHA5120b4ce217d00d6f1f76700a15aeae9cbf91a88f3e4ec96806e4f45b04480f19b734151fd74934921d8cf08ea702b49c4f88682df446d8330c6486e9169e8ec0be
-
memory/1444-27-0x0000000002AB0000-0x0000000002AB1000-memory.dmpFilesize
4KB
-
memory/1940-26-0x0000000002E10000-0x0000000002E11000-memory.dmpFilesize
4KB
-
memory/2000-16-0x000000007EFA0000-0x000000007EFAE000-memory.dmpFilesize
56KB
-
memory/2000-21-0x000000007EFA0000-0x000000007EFAE000-memory.dmpFilesize
56KB
-
memory/2000-23-0x000000007EFA0000-0x000000007EFAE000-memory.dmpFilesize
56KB
-
memory/2264-0-0x0000000000020000-0x0000000000026000-memory.dmpFilesize
24KB
-
memory/2264-3-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB
-
memory/2468-1-0x000000007EFA0000-0x000000007EFAE000-memory.dmpFilesize
56KB
-
memory/2468-2-0x000000007EFA0000-0x000000007EFAE000-memory.dmpFilesize
56KB
-
memory/2468-17-0x000000007EFA0000-0x000000007EFAE000-memory.dmpFilesize
56KB
-
memory/3068-15-0x0000000000400000-0x0000000000413000-memory.dmpFilesize
76KB