2e73d0cf56f6b36bee161bb3a17edeb3ad389fb6b8eaa9cf1ce074e5b0e970c3

Analysis

max time kernel
142s
max time network
136s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 11:11

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

7fb141fb233a9100064b77d7f23b190e.exe
Size

282KB
MD5

7fb141fb233a9100064b77d7f23b190e
SHA1

997603c51b7278975951ba0886c60252251d9366
SHA256

2e73d0cf56f6b36bee161bb3a17edeb3ad389fb6b8eaa9cf1ce074e5b0e970c3
SHA512

925ae4cc49c67329d1cfd32c12a34d19ffa34e796def81fb50b2dea6ace8ee3472c886eed04d47fcad138452af06f832ded7c63526ddcd050128d46b204de55a
SSDEEP

6144:EfyvEJCGqAlLeDcmE798Mj4HWdCB9AF4za2kaADxv9poljBn:+8AhVmEx8RHWdCJYaADxvfABn

Score

7^/10

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2816	cmd.exe

Executes dropped EXE 1 IoCs

pid	Process
2888	Happy

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat	Happy

Drops file in Program Files directory 2 IoCs

description	ioc	Process
File created	C:\Program Files (x86)\Happy	7fb141fb233a9100064b77d7f23b190e.exe
File opened for modification	C:\Program Files (x86)\Happy	7fb141fb233a9100064b77d7f23b190e.exe

Drops file in Windows directory 1 IoCs

description	ioc	Process
File created	C:\Windows\DELME.BAT	7fb141fb233a9100064b77d7f23b190e.exe

Modifies data under HKEY_USERS 28 IoCs

description	ioc	Process
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0"	Happy
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{972D583E-A792-47E5-87AC-C3FF794B7280}\WpadDecision = "0"	Happy
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings	Happy
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{972D583E-A792-47E5-87AC-C3FF794B7280}\5a-77-78-c4-8c-43	Happy
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:"	Happy
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-77-78-c4-8c-43\WpadDetectedUrl	Happy
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000004000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Happy
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{972D583E-A792-47E5-87AC-C3FF794B7280}\WpadNetworkName = "Network 3"	Happy
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-77-78-c4-8c-43	Happy
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1"	Happy
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Happy
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{972D583E-A792-47E5-87AC-C3FF794B7280}\WpadDecisionTime = e06a382ca452da01	Happy
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Happy
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{972D583E-A792-47E5-87AC-C3FF794B7280}	Happy
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{972D583E-A792-47E5-87AC-C3FF794B7280}\WpadDecisionReason = "1"	Happy
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-77-78-c4-8c-43\WpadDecisionReason = "1"	Happy
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0"	Happy
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections	Happy
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-77-78-c4-8c-43\WpadDecisionTime = 2016c6e0a352da01	Happy
Set value (int)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-77-78-c4-8c-43\WpadDecision = "0"	Happy
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix	Happy
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\5a-77-78-c4-8c-43\WpadDecisionTime = e06a382ca452da01	Happy
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings	Happy
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f00f7000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000	Happy
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{972D583E-A792-47E5-87AC-C3FF794B7280}\WpadDecisionTime = 2016c6e0a352da01	Happy
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\	Happy
Set value (str)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:"	Happy
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad	Happy

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1352	7fb141fb233a9100064b77d7f23b190e.exe
Token: SeDebugPrivilege	2888	Happy

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
2888	Happy

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 2888 wrote to memory of 2744	2888	Happy	29
PID 2888 wrote to memory of 2744	2888	Happy	29
PID 2888 wrote to memory of 2744	2888	Happy	29
PID 2888 wrote to memory of 2744	2888	Happy	29
PID 1352 wrote to memory of 2816	1352	7fb141fb233a9100064b77d7f23b190e.exe	31
PID 1352 wrote to memory of 2816	1352	7fb141fb233a9100064b77d7f23b190e.exe	31
PID 1352 wrote to memory of 2816	1352	7fb141fb233a9100064b77d7f23b190e.exe	31
PID 1352 wrote to memory of 2816	1352	7fb141fb233a9100064b77d7f23b190e.exe	31

C:\Users\Admin\AppData\Local\Temp\7fb141fb233a9100064b77d7f23b190e.exe
"C:\Users\Admin\AppData\Local\Temp\7fb141fb233a9100064b77d7f23b190e.exe"
1⤵
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352
- C:\Windows\SysWOW64\cmd.exe
  cmd /c C:\Windows\DELME.BAT
  2⤵
  - Deletes itself
  PID:2816

C:\Program Files (x86)\Happy
"C:\Program Files (x86)\Happy"
1⤵
- Executes dropped EXE
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:2888
- C:\Program Files\Internet Explorer\IEXPLORE.EXE
  "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
  2⤵
  PID:2744

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Program Files (x86)\Happy

Filesize
282KB

MD5
7fb141fb233a9100064b77d7f23b190e

SHA1
997603c51b7278975951ba0886c60252251d9366

SHA256
2e73d0cf56f6b36bee161bb3a17edeb3ad389fb6b8eaa9cf1ce074e5b0e970c3

SHA512
925ae4cc49c67329d1cfd32c12a34d19ffa34e796def81fb50b2dea6ace8ee3472c886eed04d47fcad138452af06f832ded7c63526ddcd050128d46b204de55a

Download Submit
C:\Windows\DELME.BAT

Filesize
190B

MD5
9e833095a50dc72ac7757a62c1e6593d

SHA1
35e8fe604f90574f3c148100a9fde9bd0a397a4e

SHA256
4f9bc5f669d4956d21242f943fdde54c7098de855c4cb2f85cc2786a43e29748

SHA512
d28e38fd47b7b6f0273e975c0b3e6365a0efb0769063d031e40a7973d2e88b73a9eb4752025424439c110e6c33b404b82f24526f200f1c005fa7d2caeb05008b

Download Submit
memory/1352-0-0x0000000000400000-0x000000000050D92C-memory.dmp

Filesize
1.1MB

Download
memory/1352-1-0x0000000000400000-0x000000000050D92C-memory.dmp

Filesize
1.1MB

Download
memory/1352-2-0x0000000000280000-0x0000000000281000-memory.dmp

Filesize
4KB

Download
memory/1352-16-0x0000000000400000-0x000000000050D92C-memory.dmp

Filesize
1.1MB

Download
memory/2888-6-0x0000000000400000-0x000000000050D92C-memory.dmp

Filesize
1.1MB

Download
memory/2888-9-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download
memory/2888-18-0x0000000000400000-0x000000000050D92C-memory.dmp

Filesize
1.1MB

Download
memory/2888-20-0x0000000000250000-0x0000000000251000-memory.dmp

Filesize
4KB

Download