Analysis
-
max time kernel
137s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-01-2024 11:00
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
7fac95b652bb06efa74a66efc4addbd9.exe
Resource
win7-20231215-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
7fac95b652bb06efa74a66efc4addbd9.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
7fac95b652bb06efa74a66efc4addbd9.exe
-
Size
41KB
-
MD5
7fac95b652bb06efa74a66efc4addbd9
-
SHA1
bdac1b7cdb00bb2aedb4c53aff3803c08dd69d4b
-
SHA256
0a531c9b5163019b67b4b4bebadff8a3ca8f33b909053b87ef99c94d03605e08
-
SHA512
0002f5f45f71eb24734a0ff3e6d0ad3d9113326b9d2f7e3d812472315dcc7d4e162fc9260b5ffe6a82ba34d21af08104c72d167ebf665b1eafa858b1bcc6bcb1
-
SSDEEP
768:bvzzdpJK3JGqXKeWgBMmPmM8v+l3epvDHjHN1SU9m1lNARC0I7a0cnI6kg0X+pX:bXdyJGcpMmeM84CDHzNMUq6RI7aVnBku
Score
8/10
Malware Config
Signatures
-
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBMon.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\katmain.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RunOnce.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Convert.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FrogAgent.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Msconfig.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360safe.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\avp.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Taskmgr.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Convert.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Msconfig.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMon.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\katmain.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\VsTskMgr.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\CCenter.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVCenter.kxp 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvsrvxp.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TrojDie.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavstart.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfw32.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Mcshield.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SnipeSword.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmc.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RunOnce.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UlibCfg.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\TBMon.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvxp.kxp 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KVMonXP.kxp\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Ras.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpdaterUI.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\naPrdMgr.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavmonD.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvsrvxp.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpdaterUI.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Regedit.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kpfwsvc.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KRegEx.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kavsvc.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kav32.exe 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwmain.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch.exe\debugger = "C:\\Windows\\system32\\wscntfy.exe" 7fac95b652bb06efa74a66efc4addbd9.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\1.1 7fac95b652bb06efa74a66efc4addbd9.exe File opened for modification C:\Windows\k.k 7fac95b652bb06efa74a66efc4addbd9.exe File created C:\Windows\killme.bat 7fac95b652bb06efa74a66efc4addbd9.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe 1876 7fac95b652bb06efa74a66efc4addbd9.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeSystemtimePrivilege 1876 7fac95b652bb06efa74a66efc4addbd9.exe Token: SeSystemtimePrivilege 1876 7fac95b652bb06efa74a66efc4addbd9.exe Token: SeSystemtimePrivilege 1876 7fac95b652bb06efa74a66efc4addbd9.exe Token: SeSystemtimePrivilege 1876 7fac95b652bb06efa74a66efc4addbd9.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1876 7fac95b652bb06efa74a66efc4addbd9.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1876 wrote to memory of 2484 1876 7fac95b652bb06efa74a66efc4addbd9.exe 91 PID 1876 wrote to memory of 2484 1876 7fac95b652bb06efa74a66efc4addbd9.exe 91 PID 1876 wrote to memory of 2484 1876 7fac95b652bb06efa74a66efc4addbd9.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\7fac95b652bb06efa74a66efc4addbd9.exe"C:\Users\Admin\AppData\Local\Temp\7fac95b652bb06efa74a66efc4addbd9.exe"1⤵
- Sets file execution options in registry
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1876 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c C:\Windows\killme.bat2⤵PID:2484
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
154B
MD5fa38389f54121461b2ec3ad697354bde
SHA14144205608290d44127bbf9ba26329c1ec9e284a
SHA2568b7cacda1a2c94b507482a5ec8e69abc79b020dcfce987f3d600de18d1813c00
SHA51269873cc63d539b8654a15f6da85572a7794c532af1bd52f4d2c39f7c9772c1fd7e749017d4fb52bc8905b266d213ca67e8545e612c559bd9d8aab6ef0cc8498d