Analysis
-
max time kernel
149s -
max time network
142s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
25-01-2024 16:18
Static task
static1
Behavioral task
behavioral1
Sample
74f37fe4cd2c65109465b9998183a657.exe
Resource
win7-20231215-en
General
-
Target
74f37fe4cd2c65109465b9998183a657.exe
-
Size
96KB
-
MD5
74f37fe4cd2c65109465b9998183a657
-
SHA1
9419ff643ebd890e108c2732a40f9b3628b35a71
-
SHA256
4e84e2831364f0a0b9c7d552e58b9706d0de6fae139942207af33f515dcae40b
-
SHA512
95651b579b497f8a3f4b0eb42f90bd8a722a50b38e3b6c22133ae2390e68bad21d74f7fdc4a45fc43c8aa798c5775e87bf6cb20a6e1ed9c7e80ecb9b302b4a81
-
SSDEEP
1536:TE6gioIKlNjVMa3kWq46O4ont1jlZikJ4EjkBYCBsiq5u4CzUahE7jwaaHw7Kojw:IEra3kWtfnt1xZiYGBrqJI5U5jwaaHwm
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\ujckhdcp\\dptwrdld.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dptwrdld.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\dptwrdld.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
uuortfkmptkbeqmj.exepid process 2956 uuortfkmptkbeqmj.exe -
Loads dropped DLL 4 IoCs
Processes:
74f37fe4cd2c65109465b9998183a657.exepid process 1708 74f37fe4cd2c65109465b9998183a657.exe 1708 74f37fe4cd2c65109465b9998183a657.exe 1708 74f37fe4cd2c65109465b9998183a657.exe 1708 74f37fe4cd2c65109465b9998183a657.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3818056530-936619650-3554021955-1000\Software\Microsoft\Windows\CurrentVersion\Run\DptWrdld = "C:\\Users\\Admin\\AppData\\Local\\ujckhdcp\\dptwrdld.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe 332 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 476 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
74f37fe4cd2c65109465b9998183a657.exesvchost.exesvchost.exeuuortfkmptkbeqmj.exedescription pid process Token: SeSecurityPrivilege 1708 74f37fe4cd2c65109465b9998183a657.exe Token: SeDebugPrivilege 1708 74f37fe4cd2c65109465b9998183a657.exe Token: SeSecurityPrivilege 2076 svchost.exe Token: SeSecurityPrivilege 332 svchost.exe Token: SeDebugPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeSecurityPrivilege 2956 uuortfkmptkbeqmj.exe Token: SeLoadDriverPrivilege 2956 uuortfkmptkbeqmj.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe Token: SeBackupPrivilege 332 svchost.exe Token: SeRestorePrivilege 332 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
74f37fe4cd2c65109465b9998183a657.exedescription pid process target process PID 1708 wrote to memory of 2076 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 2076 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 2076 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 2076 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 2076 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 2076 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 2076 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 2076 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 2076 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 2076 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 332 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 332 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 332 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 332 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 332 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 332 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 332 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 332 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 332 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 332 1708 74f37fe4cd2c65109465b9998183a657.exe svchost.exe PID 1708 wrote to memory of 2956 1708 74f37fe4cd2c65109465b9998183a657.exe uuortfkmptkbeqmj.exe PID 1708 wrote to memory of 2956 1708 74f37fe4cd2c65109465b9998183a657.exe uuortfkmptkbeqmj.exe PID 1708 wrote to memory of 2956 1708 74f37fe4cd2c65109465b9998183a657.exe uuortfkmptkbeqmj.exe PID 1708 wrote to memory of 2956 1708 74f37fe4cd2c65109465b9998183a657.exe uuortfkmptkbeqmj.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\74f37fe4cd2c65109465b9998183a657.exe"C:\Users\Admin\AppData\Local\Temp\74f37fe4cd2c65109465b9998183a657.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1708 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
PID:2076 -
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:332 -
C:\Users\Admin\AppData\Local\Temp\uuortfkmptkbeqmj.exe"C:\Users\Admin\AppData\Local\Temp\uuortfkmptkbeqmj.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:2956
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\ujckhdcp\dptwrdld.exeFilesize
96KB
MD574f37fe4cd2c65109465b9998183a657
SHA19419ff643ebd890e108c2732a40f9b3628b35a71
SHA2564e84e2831364f0a0b9c7d552e58b9706d0de6fae139942207af33f515dcae40b
SHA51295651b579b497f8a3f4b0eb42f90bd8a722a50b38e3b6c22133ae2390e68bad21d74f7fdc4a45fc43c8aa798c5775e87bf6cb20a6e1ed9c7e80ecb9b302b4a81
-
memory/332-42-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-57-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-88-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-87-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-62-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-43-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-93-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-92-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-91-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-61-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-90-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-89-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-27-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-33-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-60-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-59-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-50-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-56-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-53-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-54-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/332-55-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/1708-52-0x0000000077170000-0x0000000077171000-memory.dmpFilesize
4KB
-
memory/1708-5-0x000000007716F000-0x0000000077170000-memory.dmpFilesize
4KB
-
memory/1708-3-0x0000000000220000-0x0000000000222000-memory.dmpFilesize
8KB
-
memory/1708-79-0x0000000002BC0000-0x0000000002BFB000-memory.dmpFilesize
236KB
-
memory/1708-2-0x0000000000400000-0x000000000043A1A8-memory.dmpFilesize
232KB
-
memory/1708-1-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/1708-70-0x0000000002BC0000-0x0000000002BFB000-memory.dmpFilesize
236KB
-
memory/1708-78-0x000000007716F000-0x0000000077170000-memory.dmpFilesize
4KB
-
memory/1708-77-0x0000000000400000-0x000000000043A1A8-memory.dmpFilesize
232KB
-
memory/1708-6-0x0000000077170000-0x0000000077171000-memory.dmpFilesize
4KB
-
memory/1708-4-0x0000000000280000-0x0000000000281000-memory.dmpFilesize
4KB
-
memory/2076-21-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2076-24-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2076-22-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2076-20-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2076-19-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2076-18-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2076-14-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2076-10-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2076-8-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2956-86-0x0000000000400000-0x000000000043A1A8-memory.dmpFilesize
232KB
-
memory/2956-84-0x0000000000400000-0x000000000043A1A8-memory.dmpFilesize
232KB
-
memory/2956-82-0x0000000000400000-0x000000000043A1A8-memory.dmpFilesize
232KB