7f576000d22e51d72f6cb0e18bf7b9e8e6c04f857cfbd66c9b85900454e217bb

Analysis

max time kernel
120s
max time network
124s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
29/01/2024, 11:12

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

7fb1b711da7d0f513963735afbddd7b3.exe
Size

903KB
MD5

7fb1b711da7d0f513963735afbddd7b3
SHA1

fc5fd65378855ee5691914771db4192147af535c
SHA256

7f576000d22e51d72f6cb0e18bf7b9e8e6c04f857cfbd66c9b85900454e217bb
SHA512

b71d247592132edf6657339707fc567186b24f4ab353878e7a04a3d49e1e663e1e337c036bc07ea81dc5385c699647b7e580954867ed5fc30cffb1455729c785
SSDEEP

12288:/gEP0EzibDdVhbLSa412Y1+m9Hazoeo6JHN4XeXPMJvMESVc040noilVSOqnoJ:II03b5Vh3Sko8fLH+Xe/MJvMgYoilVwa

Score

8^/10

persistence

Malware Config

Signatures

Drops file in Drivers directory 3 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\drivers\sbl.sys	7fb1b711da7d0f513963735afbddd7b3.exe
File opened for modification	C:\Windows\SysWOW64\drivers\beep.sys	7fb1b711da7d0f513963735afbddd7b3.exe
File created	C:\Windows\SysWOW64\drivers\beep.sys	7fb1b711da7d0f513963735afbddd7b3.exe

Sets file execution options in registry 2 TTPs 3 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe	7fb1b711da7d0f513963735afbddd7b3.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavMonD.exe\Debugger = "C:\\Windows\\system32\\dllhost.exe"	7fb1b711da7d0f513963735afbddd7b3.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\ravmond.exe	7fb1b711da7d0f513963735afbddd7b3.exe

Drops file in System32 directory 2 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\Server.exe	7fb1b711da7d0f513963735afbddd7b3.exe
File opened for modification	C:\Windows\SysWOW64\Server.exe	7fb1b711da7d0f513963735afbddd7b3.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2400 set thread context of 2708	2400	7fb1b711da7d0f513963735afbddd7b3.exe	28

Suspicious behavior: EnumeratesProcesses 3 IoCs

pid	Process
2400	7fb1b711da7d0f513963735afbddd7b3.exe
2400	7fb1b711da7d0f513963735afbddd7b3.exe
2400	7fb1b711da7d0f513963735afbddd7b3.exe

Suspicious behavior: LoadsDriver 2 IoCs

pid	Process
468	Process not Found
468	Process not Found

Suspicious use of AdjustPrivilegeToken 1 IoCs

description	pid	Process
Token: SeDebugPrivilege	2400	7fb1b711da7d0f513963735afbddd7b3.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 2400 wrote to memory of 2708	2400	7fb1b711da7d0f513963735afbddd7b3.exe	28
PID 2400 wrote to memory of 2708	2400	7fb1b711da7d0f513963735afbddd7b3.exe	28
PID 2400 wrote to memory of 2708	2400	7fb1b711da7d0f513963735afbddd7b3.exe	28
PID 2400 wrote to memory of 2708	2400	7fb1b711da7d0f513963735afbddd7b3.exe	28
PID 2400 wrote to memory of 2708	2400	7fb1b711da7d0f513963735afbddd7b3.exe	28
PID 2400 wrote to memory of 2708	2400	7fb1b711da7d0f513963735afbddd7b3.exe	28

C:\Users\Admin\AppData\Local\Temp\7fb1b711da7d0f513963735afbddd7b3.exe
"C:\Users\Admin\AppData\Local\Temp\7fb1b711da7d0f513963735afbddd7b3.exe"
1⤵
- Drops file in Drivers directory
- Sets file execution options in registry
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2400
- C:\Windows\SysWOW64\svchost.exe
  C:\Windows\system32\svchost.exe
  2⤵
  PID:2708

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/2400-0-0x0000000000240000-0x0000000000241000-memory.dmp

Filesize
4KB

Download
memory/2400-15-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/2708-9-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2708-11-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download
memory/2708-13-0x0000000000400000-0x00000000004EA000-memory.dmp

Filesize
936KB

Download