Analysis

  • max time kernel
    119s
  • max time network
    121s
  • platform
    windows7_x64
  • resource
    win7-20231215-en
  • resource tags

    arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
  • submitted
    27-01-2024 05:27

General

  • Target

    79642aa8ae971b5e655cc5e4b989c133.exe

  • Size

    22KB

  • MD5

    79642aa8ae971b5e655cc5e4b989c133

  • SHA1

    ee12fc5dfdf42658d713c11d095627e4f1b4670e

  • SHA256

    b81f4f21017f38ee51e25e23a4357dae649554e43bd55f9a4840262af7f51144

  • SHA512

    cc32ed46904073c75c3469e6ed7f9e9a80e1bc88a52a5fb1ce2093f807bfa6c71432e842c4c9fe4025312618177083996690ce6cfbcea756236ea4bda597d3c4

  • SSDEEP

    384:cGIm/vdaWQ5UJ3vU8AZcWh36/2PA3fYQoy07uSFj2X/P57x:cGjQ5m3cz30OAvYQonuSJq3t

Score
8/10

Malware Config

Signatures

  • Sets service image path in registry 2 TTPs 1 IoCs
  • Deletes itself 1 IoCs
  • Drops file in System32 directory 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\79642aa8ae971b5e655cc5e4b989c133.exe
    "C:\Users\Admin\AppData\Local\Temp\79642aa8ae971b5e655cc5e4b989c133.exe"
    1⤵
    • Drops file in System32 directory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2516
    • \??\c:\users\admin\appdata\local\temp\79642aa8ae971b5e655cc5e4b989c133.exe
      c:\users\admin\appdata\local\temp\79642aa8ae971b5e655cc5e4b989c133.exe
      2⤵
      • Suspicious use of SetThreadContext
      • Suspicious use of WriteProcessMemory
      PID:1644
      • C:\Windows\SysWOW64\svchost.exe
        C:\Windows\system32\svchost.exe
        3⤵
        • Sets service image path in registry
        • Deletes itself
        PID:2892

Network

MITRE ATT&CK Matrix ATT&CK v13

Persistence

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

1
T1547

Registry Run Keys / Startup Folder

1
T1547.001

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • \??\c:\windows\SysWOW64\mssrv32.exe
    Filesize

    22KB

    MD5

    79642aa8ae971b5e655cc5e4b989c133

    SHA1

    ee12fc5dfdf42658d713c11d095627e4f1b4670e

    SHA256

    b81f4f21017f38ee51e25e23a4357dae649554e43bd55f9a4840262af7f51144

    SHA512

    cc32ed46904073c75c3469e6ed7f9e9a80e1bc88a52a5fb1ce2093f807bfa6c71432e842c4c9fe4025312618177083996690ce6cfbcea756236ea4bda597d3c4

  • memory/1644-3-0x0000000015110000-0x000000001511A000-memory.dmp
    Filesize

    40KB

  • memory/1644-7-0x0000000015110000-0x000000001511A000-memory.dmp
    Filesize

    40KB

  • memory/2516-0-0x0000000015110000-0x000000001511A000-memory.dmp
    Filesize

    40KB

  • memory/2516-2-0x0000000001C20000-0x0000000001C2A000-memory.dmp
    Filesize

    40KB

  • memory/2516-8-0x0000000015110000-0x000000001511A000-memory.dmp
    Filesize

    40KB

  • memory/2892-10-0x0000000015110000-0x000000001511A000-memory.dmp
    Filesize

    40KB

  • memory/2892-11-0x0000000015110000-0x000000001511A000-memory.dmp
    Filesize

    40KB

  • memory/2892-12-0x0000000015110000-0x000000001511A000-memory.dmp
    Filesize

    40KB