Analysis
-
max time kernel
143s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
27-01-2024 05:27
Static task
static1
Behavioral task
behavioral1
Sample
79642aa8ae971b5e655cc5e4b989c133.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
79642aa8ae971b5e655cc5e4b989c133.exe
Resource
win10v2004-20231215-en
General
-
Target
79642aa8ae971b5e655cc5e4b989c133.exe
-
Size
22KB
-
MD5
79642aa8ae971b5e655cc5e4b989c133
-
SHA1
ee12fc5dfdf42658d713c11d095627e4f1b4670e
-
SHA256
b81f4f21017f38ee51e25e23a4357dae649554e43bd55f9a4840262af7f51144
-
SHA512
cc32ed46904073c75c3469e6ed7f9e9a80e1bc88a52a5fb1ce2093f807bfa6c71432e842c4c9fe4025312618177083996690ce6cfbcea756236ea4bda597d3c4
-
SSDEEP
384:cGIm/vdaWQ5UJ3vU8AZcWh36/2PA3fYQoy07uSFj2X/P57x:cGjQ5m3cz30OAvYQonuSJq3t
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\msupdate\ImagePath = "c:\\windows\\system32\\mssrv32.exe" svchost.exe -
Deletes itself 1 IoCs
Processes:
svchost.exepid process 3320 svchost.exe -
Drops file in System32 directory 2 IoCs
Processes:
79642aa8ae971b5e655cc5e4b989c133.exedescription ioc process File created \??\c:\windows\SysWOW64\mssrv32.exe 79642aa8ae971b5e655cc5e4b989c133.exe File opened for modification \??\c:\windows\SysWOW64\mssrv32.exe 79642aa8ae971b5e655cc5e4b989c133.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
79642aa8ae971b5e655cc5e4b989c133.exedescription pid process target process PID 452 set thread context of 3320 452 79642aa8ae971b5e655cc5e4b989c133.exe svchost.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 3308 3320 WerFault.exe svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
79642aa8ae971b5e655cc5e4b989c133.exedescription pid process Token: SeDebugPrivilege 4956 79642aa8ae971b5e655cc5e4b989c133.exe -
Suspicious use of WriteProcessMemory 7 IoCs
Processes:
79642aa8ae971b5e655cc5e4b989c133.exe79642aa8ae971b5e655cc5e4b989c133.exedescription pid process target process PID 4956 wrote to memory of 452 4956 79642aa8ae971b5e655cc5e4b989c133.exe 79642aa8ae971b5e655cc5e4b989c133.exe PID 4956 wrote to memory of 452 4956 79642aa8ae971b5e655cc5e4b989c133.exe 79642aa8ae971b5e655cc5e4b989c133.exe PID 4956 wrote to memory of 452 4956 79642aa8ae971b5e655cc5e4b989c133.exe 79642aa8ae971b5e655cc5e4b989c133.exe PID 452 wrote to memory of 3320 452 79642aa8ae971b5e655cc5e4b989c133.exe svchost.exe PID 452 wrote to memory of 3320 452 79642aa8ae971b5e655cc5e4b989c133.exe svchost.exe PID 452 wrote to memory of 3320 452 79642aa8ae971b5e655cc5e4b989c133.exe svchost.exe PID 452 wrote to memory of 3320 452 79642aa8ae971b5e655cc5e4b989c133.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\79642aa8ae971b5e655cc5e4b989c133.exe"C:\Users\Admin\AppData\Local\Temp\79642aa8ae971b5e655cc5e4b989c133.exe"1⤵
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
\??\c:\users\admin\appdata\local\temp\79642aa8ae971b5e655cc5e4b989c133.exec:\users\admin\appdata\local\temp\79642aa8ae971b5e655cc5e4b989c133.exe2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe3⤵
- Sets service image path in registry
- Deletes itself
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3320 -s 3404⤵
- Program crash
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 408 -p 3320 -ip 33201⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\??\c:\windows\SysWOW64\mssrv32.exeFilesize
22KB
MD579642aa8ae971b5e655cc5e4b989c133
SHA1ee12fc5dfdf42658d713c11d095627e4f1b4670e
SHA256b81f4f21017f38ee51e25e23a4357dae649554e43bd55f9a4840262af7f51144
SHA512cc32ed46904073c75c3469e6ed7f9e9a80e1bc88a52a5fb1ce2093f807bfa6c71432e842c4c9fe4025312618177083996690ce6cfbcea756236ea4bda597d3c4
-
memory/452-3-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB
-
memory/3320-2-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB
-
memory/3320-6-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB
-
memory/4956-0-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB
-
memory/4956-4-0x0000000015110000-0x000000001511A000-memory.dmpFilesize
40KB