Analysis
-
max time kernel
119s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
27-01-2024 05:27
Static task
static1
Behavioral task
behavioral1
Sample
79642aa8ae971b5e655cc5e4b989c133.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
79642aa8ae971b5e655cc5e4b989c133.exe
Resource
win10v2004-20231215-en
General
-
Target
79642aa8ae971b5e655cc5e4b989c133.exe
-
Size
22KB
-
MD5
79642aa8ae971b5e655cc5e4b989c133
-
SHA1
ee12fc5dfdf42658d713c11d095627e4f1b4670e
-
SHA256
b81f4f21017f38ee51e25e23a4357dae649554e43bd55f9a4840262af7f51144
-
SHA512
cc32ed46904073c75c3469e6ed7f9e9a80e1bc88a52a5fb1ce2093f807bfa6c71432e842c4c9fe4025312618177083996690ce6cfbcea756236ea4bda597d3c4
-
SSDEEP
384:cGIm/vdaWQ5UJ3vU8AZcWh36/2PA3fYQoy07uSFj2X/P57x:cGjQ5m3cz30OAvYQonuSJq3t
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\msupdate\ImagePath = "c:\\windows\\system32\\mssrv32.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 2892 svchost.exe -
Drops file in System32 directory 2 IoCs
Processes:
79642aa8ae971b5e655cc5e4b989c133.exedescription ioc process File created \??\c:\windows\SysWOW64\mssrv32.exe 79642aa8ae971b5e655cc5e4b989c133.exe File opened for modification \??\c:\windows\SysWOW64\mssrv32.exe 79642aa8ae971b5e655cc5e4b989c133.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
79642aa8ae971b5e655cc5e4b989c133.exedescription pid process target process PID 1644 set thread context of 2892 1644 79642aa8ae971b5e655cc5e4b989c133.exe svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
79642aa8ae971b5e655cc5e4b989c133.exedescription pid process Token: SeDebugPrivilege 2516 79642aa8ae971b5e655cc5e4b989c133.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
79642aa8ae971b5e655cc5e4b989c133.exe79642aa8ae971b5e655cc5e4b989c133.exedescription pid process target process PID 2516 wrote to memory of 1644 2516 79642aa8ae971b5e655cc5e4b989c133.exe 79642aa8ae971b5e655cc5e4b989c133.exe PID 2516 wrote to memory of 1644 2516 79642aa8ae971b5e655cc5e4b989c133.exe 79642aa8ae971b5e655cc5e4b989c133.exe PID 2516 wrote to memory of 1644 2516 79642aa8ae971b5e655cc5e4b989c133.exe 79642aa8ae971b5e655cc5e4b989c133.exe PID 2516 wrote to memory of 1644 2516 79642aa8ae971b5e655cc5e4b989c133.exe 79642aa8ae971b5e655cc5e4b989c133.exe PID 1644 wrote to memory of 2892 1644 79642aa8ae971b5e655cc5e4b989c133.exe svchost.exe PID 1644 wrote to memory of 2892 1644 79642aa8ae971b5e655cc5e4b989c133.exe svchost.exe PID 1644 wrote to memory of 2892 1644 79642aa8ae971b5e655cc5e4b989c133.exe svchost.exe PID 1644 wrote to memory of 2892 1644 79642aa8ae971b5e655cc5e4b989c133.exe svchost.exe PID 1644 wrote to memory of 2892 1644 79642aa8ae971b5e655cc5e4b989c133.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79642aa8ae971b5e655cc5e4b989c133.exe"C:\Users\Admin\AppData\Local\Temp\79642aa8ae971b5e655cc5e4b989c133.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\79642aa8ae971b5e655cc5e4b989c133.exec:\users\admin\appdata\local\temp\79642aa8ae971b5e655cc5e4b989c133.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Sets service image path in registry
- Deletes itself
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\windows\SysWOW64\mssrv32.exeFilesize
22KB
MD579642aa8ae971b5e655cc5e4b989c133
SHA1ee12fc5dfdf42658d713c11d095627e4f1b4670e
SHA256b81f4f21017f38ee51e25e23a4357dae649554e43bd55f9a4840262af7f51144
SHA512cc32ed46904073c75c3469e6ed7f9e9a80e1bc88a52a5fb1ce2093f807bfa6c71432e842c4c9fe4025312618177083996690ce6cfbcea756236ea4bda597d3c4
-
memory/1644-3-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB
-
memory/1644-7-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB
-
memory/2516-0-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB
-
memory/2516-2-0x0000000001C20000-0x0000000001C2A000-memory.dmpFilesize
40KB
-
memory/2516-8-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB
-
memory/2892-10-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB
-
memory/2892-11-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB
-
memory/2892-12-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB