Analysis
-
max time kernel
146s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
01-02-2024 07:21
Behavioral task
behavioral1
Sample
86480098a813b1cd670ea1220741c8be.exe
Resource
win7-20231215-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
86480098a813b1cd670ea1220741c8be.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
86480098a813b1cd670ea1220741c8be.exe
-
Size
102KB
-
MD5
86480098a813b1cd670ea1220741c8be
-
SHA1
1896bd3d1f958ba1c204d69ed738257d1a17ce53
-
SHA256
f01aca0a106e21a693545db472a72e24aeb2168e8fb4a9f0802a04da41898337
-
SHA512
792295cf5164d7bb00084d84e6a277df4e8144ecdca1a7268901a6c6890d3fac90d5c61903441b1b8d3165d63b640143f556a2fd8405812fbd9a9db639472341
-
SSDEEP
1536:oGMh+pkUkLewYzh1wuNFBa4veaGSM04EQqyb5Gi+NCtd9MUYHT1c3Kw/z4iJmkFR:TMenkOguNHaCGpWfUYH2sk78U
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 4920 pitifd.exe -
resource yara_rule behavioral2/memory/3592-0-0x0000000000400000-0x000000000044E000-memory.dmp upx behavioral2/files/0x000900000002314c-5.dat upx behavioral2/memory/3592-8-0x0000000000400000-0x000000000044E000-memory.dmp upx behavioral2/memory/4920-9-0x0000000000400000-0x000000000044E000-memory.dmp upx -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pitifd = "C:\\Windows\\system32\\iypnb\\pitifd.exe" 86480098a813b1cd670ea1220741c8be.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pitifd = "C:\\Windows\\SysWOW64\\iypnb\\pitifd.exe" pitifd.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File opened for modification C:\Windows\SysWOW64\iypnb\6CA5.tmp 86480098a813b1cd670ea1220741c8be.exe File opened for modification C:\Windows\SysWOW64\iypnb\pitifd.exe pitifd.exe -
Modifies data under HKEY_USERS 27 IoCs
description ioc Process Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer pitifd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyServer 86480098a813b1cd670ea1220741c8be.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections pitifd.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 pitifd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Media\WMSDK 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.default\Software\Microsoft\MediaPlayer\Player\Settings 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.default\Software\Microsoft\MediaPlayer\Player\Settings pitifd.exe Key created \REGISTRY\USER\.default 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General 86480098a813b1cd670ea1220741c8be.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\UniqueID 86480098a813b1cd670ea1220741c8be.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 86480098a813b1cd670ea1220741c8be.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Media\WMSDK\General\UniqueID pitifd.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Player\Settings\Client ID = "{D094766A-638C-4D59-A2A7-6AE2D0CBABBE}" 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.default\Software\Microsoft\Windows Media\WMSDK\General pitifd.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Media 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Player\Settings 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.default\Software\Microsoft\Windows\CurrentVersion\Internet Settings pitifd.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" pitifd.exe Key created \REGISTRY\USER\.default\Software\Microsoft\Windows Media\WMSDK\General 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.DEFAULT\Software 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Player 86480098a813b1cd670ea1220741c8be.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\MediaPlayer\Player\Settings\Client ID = "{D094766A-638C-4D59-A2A7-6AE2D0CBABBE}" pitifd.exe -
Modifies registry class 11 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94E5563F-00D7-0613-46A5-A19DAEEDF45C}\ = " " 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33DFD6B3-4B21-A330-758C-A111068053A4} 86480098a813b1cd670ea1220741c8be.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33DFD6B3-4B21-A330-758C-A111068053A4}\InprocServer32\ = "C:\\Windows\\SysWow64\\iypnb\\pitifd.exe" 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A57F90A-2641-AF83-4C13-F19EA6EDD9ED} 86480098a813b1cd670ea1220741c8be.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A57F90A-2641-AF83-4C13-F19EA6EDD9ED}\Version\ 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{94E5563F-00D7-0613-46A5-A19DAEEDF45C} 86480098a813b1cd670ea1220741c8be.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A57F90A-2641-AF83-4C13-F19EA6EDD9ED}\Version\ = "2005-02-24 14:36:07" 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{33DFD6B3-4B21-A330-758C-A111068053A4}\InprocServer32 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{6A57F90A-2641-AF83-4C13-F19EA6EDD9ED}\Version 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node 86480098a813b1cd670ea1220741c8be.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID 86480098a813b1cd670ea1220741c8be.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 3592 86480098a813b1cd670ea1220741c8be.exe 4920 pitifd.exe 4920 pitifd.exe 4920 pitifd.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 3592 86480098a813b1cd670ea1220741c8be.exe Token: SeDebugPrivilege 4920 pitifd.exe Token: SeDebugPrivilege 4920 pitifd.exe Token: SeDebugPrivilege 4920 pitifd.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3592 wrote to memory of 4920 3592 86480098a813b1cd670ea1220741c8be.exe 94 PID 3592 wrote to memory of 4920 3592 86480098a813b1cd670ea1220741c8be.exe 94 PID 3592 wrote to memory of 4920 3592 86480098a813b1cd670ea1220741c8be.exe 94
Processes
-
C:\Users\Admin\AppData\Local\Temp\86480098a813b1cd670ea1220741c8be.exe"C:\Users\Admin\AppData\Local\Temp\86480098a813b1cd670ea1220741c8be.exe"1⤵
- Adds Run key to start application
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3592 -
C:\Windows\SysWOW64\iypnb\pitifd.exeC:\Windows\system32\iypnb\pitifd.exe2⤵
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:4920
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
102KB
MD586480098a813b1cd670ea1220741c8be
SHA11896bd3d1f958ba1c204d69ed738257d1a17ce53
SHA256f01aca0a106e21a693545db472a72e24aeb2168e8fb4a9f0802a04da41898337
SHA512792295cf5164d7bb00084d84e6a277df4e8144ecdca1a7268901a6c6890d3fac90d5c61903441b1b8d3165d63b640143f556a2fd8405812fbd9a9db639472341