839df8607556ddaa7e1c678811e19b4f2b52fb00294eb135c9c4587d79f7b386

Analysis

max time kernel
143s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20231215-en
resource tags

arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system
submitted
29/01/2024, 08:58

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7f6d7d02023c33f3396eb96d9602acff.exe
Size

602KB
MD5

7f6d7d02023c33f3396eb96d9602acff
SHA1

a5d4a7afbae81ca76c41f7ea1f7bbf17831f39ba
SHA256

839df8607556ddaa7e1c678811e19b4f2b52fb00294eb135c9c4587d79f7b386
SHA512

64cf110e85e8019bdc46348a5d2f6acb82e294492a9b3a81e608461dc2d43d4fec58a634e51f002e7a8a80894ee87c0a0193d138cf9f11d5092a5d8115ec794a
SSDEEP

12288:m1wIZl1Vz0+41dx1d9Bh2VKpFG2NUtzXWzRsO22XHgWQw:m1HZl1Vz03x1dBTkuXHgk

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
4988	systen32

Drops file in Windows directory 3 IoCs

description	ioc	Process
File created	C:\Windows\uninstal.bat	7f6d7d02023c33f3396eb96d9602acff.exe
File created	C:\Windows\systen32	7f6d7d02023c33f3396eb96d9602acff.exe
File opened for modification	C:\Windows\systen32	7f6d7d02023c33f3396eb96d9602acff.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\IntranetName = "1"	systen32
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "1"	systen32
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "0"	systen32
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	systen32
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ProxyBypass = "1"	systen32

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1600	7f6d7d02023c33f3396eb96d9602acff.exe
Token: SeDebugPrivilege	4988	systen32

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
4988	systen32

Suspicious use of WriteProcessMemory 5 IoCs

description	pid	Process	procid_target
PID 1600 wrote to memory of 2188	1600	7f6d7d02023c33f3396eb96d9602acff.exe	87
PID 1600 wrote to memory of 2188	1600	7f6d7d02023c33f3396eb96d9602acff.exe	87
PID 1600 wrote to memory of 2188	1600	7f6d7d02023c33f3396eb96d9602acff.exe	87
PID 4988 wrote to memory of 408	4988	systen32	85
PID 4988 wrote to memory of 408	4988	systen32	85

C:\Users\Admin\AppData\Local\Temp\7f6d7d02023c33f3396eb96d9602acff.exe
"C:\Users\Admin\AppData\Local\Temp\7f6d7d02023c33f3396eb96d9602acff.exe"
1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1600
- C:\Windows\SysWOW64\cmd.exe
  C:\Windows\system32\cmd.exe /c C:\Windows\uninstal.bat
  2⤵
  PID:2188

C:\Windows\systen32
C:\Windows\systen32
1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4988
- C:\Program Files\Internet EXPLORER\IexplOrE.ExE
  "C:\Program Files\Internet EXPLORER\IexplOrE.ExE"
  2⤵
  PID:408

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Windows\systen32

Filesize
602KB

MD5
7f6d7d02023c33f3396eb96d9602acff

SHA1
a5d4a7afbae81ca76c41f7ea1f7bbf17831f39ba

SHA256
839df8607556ddaa7e1c678811e19b4f2b52fb00294eb135c9c4587d79f7b386

SHA512
64cf110e85e8019bdc46348a5d2f6acb82e294492a9b3a81e608461dc2d43d4fec58a634e51f002e7a8a80894ee87c0a0193d138cf9f11d5092a5d8115ec794a

Download Submit
C:\Windows\uninstal.bat

Filesize
190B

MD5
9b953dd133edde943649a34179363bbe

SHA1
f6b0fe8bacd93fadb332b86a94b5727139ab0d0b

SHA256
1d61f8ca9c805e7b45d35c432ca3123ad76d9e4d6814883833dd054075a7ea6f

SHA512
4b87d40609f769f2111022c41592b9fbeb2d70bb9e179cfbe86e7008f25746fc28207037bc404315ff7e9a3693a77c954a8d705237853238e1a31db6c9f18af9

Download Submit
memory/1600-22-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/1600-16-0x0000000003580000-0x0000000003581000-memory.dmp

Filesize
4KB

Download
memory/1600-5-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/1600-4-0x0000000002570000-0x0000000002571000-memory.dmp

Filesize
4KB

Download
memory/1600-6-0x00000000025C0000-0x00000000025C1000-memory.dmp

Filesize
4KB

Download
memory/1600-7-0x0000000002550000-0x0000000002551000-memory.dmp

Filesize
4KB

Download
memory/1600-8-0x0000000002540000-0x0000000002541000-memory.dmp

Filesize
4KB

Download
memory/1600-9-0x00000000025B0000-0x00000000025B1000-memory.dmp

Filesize
4KB

Download
memory/1600-10-0x00000000025A0000-0x00000000025A1000-memory.dmp

Filesize
4KB

Download
memory/1600-11-0x00000000025D0000-0x00000000025D1000-memory.dmp

Filesize
4KB

Download
memory/1600-12-0x0000000002560000-0x0000000002561000-memory.dmp

Filesize
4KB

Download
memory/1600-13-0x0000000003530000-0x0000000003531000-memory.dmp

Filesize
4KB

Download
memory/1600-14-0x0000000003520000-0x0000000003521000-memory.dmp

Filesize
4KB

Download
memory/1600-15-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/1600-23-0x0000000002520000-0x0000000002521000-memory.dmp

Filesize
4KB

Download
memory/1600-19-0x0000000003570000-0x0000000003571000-memory.dmp

Filesize
4KB

Download
memory/1600-20-0x00000000035A0000-0x00000000035A1000-memory.dmp

Filesize
4KB

Download
memory/1600-21-0x0000000003590000-0x0000000003591000-memory.dmp

Filesize
4KB

Download
memory/1600-3-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/1600-0-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/1600-1-0x0000000002310000-0x0000000002364000-memory.dmp

Filesize
336KB

Download
memory/1600-25-0x00000000025E0000-0x00000000025E1000-memory.dmp

Filesize
4KB

Download
memory/1600-2-0x0000000002590000-0x0000000002591000-memory.dmp

Filesize
4KB

Download
memory/1600-42-0x0000000002310000-0x0000000002364000-memory.dmp

Filesize
336KB

Download
memory/1600-24-0x00000000035B0000-0x00000000035B1000-memory.dmp

Filesize
4KB

Download
memory/4988-30-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/4988-41-0x0000000000DE0000-0x0000000000E34000-memory.dmp

Filesize
336KB

Download
memory/4988-33-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/4988-35-0x0000000002110000-0x0000000002111000-memory.dmp

Filesize
4KB

Download
memory/4988-34-0x00000000020F0000-0x00000000020F1000-memory.dmp

Filesize
4KB

Download
memory/4988-28-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/4988-31-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/4988-38-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/4988-36-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/4988-43-0x0000000001410000-0x0000000001411000-memory.dmp

Filesize
4KB

Download
memory/4988-40-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download
memory/4988-29-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/4988-32-0x00000000020A0000-0x00000000020A1000-memory.dmp

Filesize
4KB

Download
memory/4988-45-0x0000000000400000-0x000000000056593C-memory.dmp

Filesize
1.4MB

Download
memory/4988-46-0x0000000000E90000-0x0000000000E91000-memory.dmp

Filesize
4KB

Download