Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
22/01/2024, 00:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6e2fb9abe3419002ed655109d4ec85f5.exe
Resource
win7-20231215-en
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
6e2fb9abe3419002ed655109d4ec85f5.exe
Resource
win10v2004-20231215-en
7 signatures
150 seconds
General
-
Target
6e2fb9abe3419002ed655109d4ec85f5.exe
-
Size
234KB
-
MD5
6e2fb9abe3419002ed655109d4ec85f5
-
SHA1
781f1be80c1b4e563b2314aa24b8971e42b42a80
-
SHA256
fa725ece6f7cf6149d8b5a637f9f254efb105e184276666ba07ef9812564626b
-
SHA512
235edd74aef197bc62e7a244e71b2fa633d79e8add0a48340e9d8e8f5fc491a090968716d6d921e2beecb6115df097a65fed8ce1f33ce3167a4a46ce0534decf
-
SSDEEP
3072:oF8uspQjfwe2IhASAt7q80brmX71hEbaFSkjiRrP:oWpoVhA9t7vorva+
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\HWMonitor = "C:\\Users\\Admin\\AppData\\Roaming\\HWMonitor\\HWMonitor.exe" powershell.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 2756 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1848 6e2fb9abe3419002ed655109d4ec85f5.exe Token: SeDebugPrivilege 2756 powershell.exe -
Suspicious use of WriteProcessMemory 19 IoCs
description pid Process procid_target PID 1848 wrote to memory of 2756 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 28 PID 1848 wrote to memory of 2756 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 28 PID 1848 wrote to memory of 2756 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 28 PID 1848 wrote to memory of 2756 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 28 PID 1848 wrote to memory of 2716 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 30 PID 1848 wrote to memory of 2716 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 30 PID 1848 wrote to memory of 2716 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 30 PID 1848 wrote to memory of 2716 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 30 PID 1848 wrote to memory of 2716 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 30 PID 1848 wrote to memory of 2716 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 30 PID 1848 wrote to memory of 2716 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 30 PID 1848 wrote to memory of 2648 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 31 PID 1848 wrote to memory of 2648 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 31 PID 1848 wrote to memory of 2648 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 31 PID 1848 wrote to memory of 2648 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 31 PID 1848 wrote to memory of 2648 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 31 PID 1848 wrote to memory of 2648 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 31 PID 1848 wrote to memory of 2648 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 31 PID 1848 wrote to memory of 2648 1848 6e2fb9abe3419002ed655109d4ec85f5.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\6e2fb9abe3419002ed655109d4ec85f5.exe"C:\Users\Admin\AppData\Local\Temp\6e2fb9abe3419002ed655109d4ec85f5.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1848 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell.exe" Remove-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'HWMonitor';New-ItemProperty -Path 'HKCU:\SOFTWARE\Microsoft\Windows\CurrentVersion\Run' -Name 'HWMonitor' -Value '"C:\Users\Admin\AppData\Roaming\HWMonitor\HWMonitor.exe"' -PropertyType 'String'2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2756
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2716
-
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵PID:2648
-