Analysis
-
max time kernel
150s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
24-01-2024 11:59
Static task
static1
Behavioral task
behavioral1
Sample
722e63f8910e9fe1d7775c3a0495de54.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
722e63f8910e9fe1d7775c3a0495de54.exe
Resource
win10v2004-20231222-en
General
-
Target
722e63f8910e9fe1d7775c3a0495de54.exe
-
Size
320KB
-
MD5
722e63f8910e9fe1d7775c3a0495de54
-
SHA1
88041f0b4f76532cdf45b48591f7953e83981070
-
SHA256
fe893dcee37d4c6e62ec9afcf149062916a51af6141323ff74ae361a95105273
-
SHA512
7f9f74da10056e30b86fe50d192c4c3410b7bd9c6429331980834571d04b9609174c240dca9512d933e9d8f051c4b567aefb2714868785907bd927a50a7c7a1b
-
SSDEEP
6144:qCo86w8tceyv3WsJZAShsJduZKMjHaJUCo0nyglJ//MQ/81hpPbbcjdwEpqK:wLw8t/gGsIpduZJax/r3MQ/Msxw2qK
Malware Config
Signatures
-
Deletes itself 1 IoCs
Processes:
bD22003JeFjH22003.exepid process 2816 bD22003JeFjH22003.exe -
Executes dropped EXE 1 IoCs
Processes:
bD22003JeFjH22003.exepid process 2816 bD22003JeFjH22003.exe -
Loads dropped DLL 2 IoCs
Processes:
722e63f8910e9fe1d7775c3a0495de54.exepid process 1520 722e63f8910e9fe1d7775c3a0495de54.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe -
Processes:
resource yara_rule behavioral1/memory/1520-0-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral1/memory/1520-2-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral1/memory/1520-9-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral1/memory/2816-28-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral1/memory/1520-36-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral1/memory/2816-37-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral1/memory/2816-49-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral1/memory/1520-52-0x0000000000400000-0x00000000004C3000-memory.dmp upx behavioral1/memory/2816-56-0x0000000000400000-0x00000000004C3000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bD22003JeFjH22003.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\bD22003JeFjH22003 = "C:\\ProgramData\\bD22003JeFjH22003\\bD22003JeFjH22003.exe" bD22003JeFjH22003.exe -
Processes:
bD22003JeFjH22003.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Internet Explorer\Main bD22003JeFjH22003.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
722e63f8910e9fe1d7775c3a0495de54.exebD22003JeFjH22003.exepid process 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe 1520 722e63f8910e9fe1d7775c3a0495de54.exe 2816 bD22003JeFjH22003.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
722e63f8910e9fe1d7775c3a0495de54.exebD22003JeFjH22003.exedescription pid process Token: SeDebugPrivilege 1520 722e63f8910e9fe1d7775c3a0495de54.exe Token: SeDebugPrivilege 2816 bD22003JeFjH22003.exe -
Suspicious use of FindShellTrayWindow 6 IoCs
Processes:
bD22003JeFjH22003.exepid process 2816 bD22003JeFjH22003.exe 2816 bD22003JeFjH22003.exe 2816 bD22003JeFjH22003.exe 2816 bD22003JeFjH22003.exe 2816 bD22003JeFjH22003.exe 2816 bD22003JeFjH22003.exe -
Suspicious use of SendNotifyMessage 6 IoCs
Processes:
bD22003JeFjH22003.exepid process 2816 bD22003JeFjH22003.exe 2816 bD22003JeFjH22003.exe 2816 bD22003JeFjH22003.exe 2816 bD22003JeFjH22003.exe 2816 bD22003JeFjH22003.exe 2816 bD22003JeFjH22003.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
bD22003JeFjH22003.exepid process 2816 bD22003JeFjH22003.exe 2816 bD22003JeFjH22003.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
722e63f8910e9fe1d7775c3a0495de54.exedescription pid process target process PID 1520 wrote to memory of 2816 1520 722e63f8910e9fe1d7775c3a0495de54.exe bD22003JeFjH22003.exe PID 1520 wrote to memory of 2816 1520 722e63f8910e9fe1d7775c3a0495de54.exe bD22003JeFjH22003.exe PID 1520 wrote to memory of 2816 1520 722e63f8910e9fe1d7775c3a0495de54.exe bD22003JeFjH22003.exe PID 1520 wrote to memory of 2816 1520 722e63f8910e9fe1d7775c3a0495de54.exe bD22003JeFjH22003.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\722e63f8910e9fe1d7775c3a0495de54.exe"C:\Users\Admin\AppData\Local\Temp\722e63f8910e9fe1d7775c3a0495de54.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\ProgramData\bD22003JeFjH22003\bD22003JeFjH22003.exe"C:\ProgramData\bD22003JeFjH22003\bD22003JeFjH22003.exe" "C:\Users\Admin\AppData\Local\Temp\722e63f8910e9fe1d7775c3a0495de54.exe"2⤵
- Deletes itself
- Executes dropped EXE
- Adds Run key to start application
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\ProgramData\bD22003JeFjH22003\bD22003JeFjH22003.exeFilesize
320KB
MD58d78965462fb6b53dad06670d9ee299d
SHA1db0d0277a876a2b896ffef35bd352f801fd3c5c7
SHA256e6bd84837a9c23b6071fcfd4b1ad964c26e51ebaab8930503c0fd056d549e1de
SHA512a811b3c32f6fbea431b9697515d0fb7ea64828d2da9c24cb99f3755ae73d61283c1fba05e8afbd6dc6f8ead97870b7ab3fbc72e17a6cd1e6fefa302449350955
-
memory/1520-1-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/1520-0-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/1520-3-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/1520-2-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/1520-9-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/1520-36-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/1520-52-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2816-28-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2816-37-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2816-49-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB
-
memory/2816-56-0x0000000000400000-0x00000000004C3000-memory.dmpFilesize
780KB