Analysis
-
max time kernel
150s -
max time network
144s -
platform
windows7_x64 -
resource
win7-20231215-en -
resource tags
arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system -
submitted
01-02-2024 16:45
Static task
static1
Behavioral task
behavioral1
Sample
87633eb6eeb7edd72ded8e33ef0c2920.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
87633eb6eeb7edd72ded8e33ef0c2920.exe
Resource
win10v2004-20231222-en
General
-
Target
87633eb6eeb7edd72ded8e33ef0c2920.exe
-
Size
124KB
-
MD5
87633eb6eeb7edd72ded8e33ef0c2920
-
SHA1
ec1e166039a14fedb584f04a50bca85af36f00fb
-
SHA256
1c896bcb561ed46a1b63bb55acdb1249d0f1151b415b54d57ece2a1a37ad712d
-
SHA512
3fd660edc3dd66780050e751fc830262c1adaa61611ee799927b427c595c0ce5f96f6a893669a2bd18c8652e0870deabda5e14968c91395e34e18de059ad78cc
-
SSDEEP
3072:GlhkajfwqM9F1DDmMtSNV5PuqLJsoUm9IYcsF+LnJ5d7q+:GXkajovDmMtSNVNSm9JinrV
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\fkotrkjd\\nnggcnpt.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nnggcnpt.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\nnggcnpt.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
fveeeprafhyjbrba.exepid process 3052 fveeeprafhyjbrba.exe -
Loads dropped DLL 4 IoCs
Processes:
87633eb6eeb7edd72ded8e33ef0c2920.exepid process 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3601492379-692465709-652514833-1000\Software\Microsoft\Windows\CurrentVersion\Run\NngGcnpt = "C:\\Users\\Admin\\AppData\\Local\\fkotrkjd\\nnggcnpt.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe 2828 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 484 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
87633eb6eeb7edd72ded8e33ef0c2920.exesvchost.exesvchost.exefveeeprafhyjbrba.exedescription pid process Token: SeSecurityPrivilege 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe Token: SeDebugPrivilege 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe Token: SeSecurityPrivilege 2136 svchost.exe Token: SeSecurityPrivilege 2828 svchost.exe Token: SeDebugPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeSecurityPrivilege 3052 fveeeprafhyjbrba.exe Token: SeLoadDriverPrivilege 3052 fveeeprafhyjbrba.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe Token: SeBackupPrivilege 2828 svchost.exe Token: SeRestorePrivilege 2828 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
87633eb6eeb7edd72ded8e33ef0c2920.exedescription pid process target process PID 1904 wrote to memory of 2136 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2136 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2136 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2136 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2136 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2136 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2136 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2136 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2136 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2136 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2828 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2828 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2828 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2828 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2828 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2828 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2828 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2828 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2828 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 2828 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe svchost.exe PID 1904 wrote to memory of 3052 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe fveeeprafhyjbrba.exe PID 1904 wrote to memory of 3052 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe fveeeprafhyjbrba.exe PID 1904 wrote to memory of 3052 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe fveeeprafhyjbrba.exe PID 1904 wrote to memory of 3052 1904 87633eb6eeb7edd72ded8e33ef0c2920.exe fveeeprafhyjbrba.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\87633eb6eeb7edd72ded8e33ef0c2920.exe"C:\Users\Admin\AppData\Local\Temp\87633eb6eeb7edd72ded8e33ef0c2920.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\fveeeprafhyjbrba.exe"C:\Users\Admin\AppData\Local\Temp\fveeeprafhyjbrba.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\fkotrkjd\nnggcnpt.exeFilesize
124KB
MD587633eb6eeb7edd72ded8e33ef0c2920
SHA1ec1e166039a14fedb584f04a50bca85af36f00fb
SHA2561c896bcb561ed46a1b63bb55acdb1249d0f1151b415b54d57ece2a1a37ad712d
SHA5123fd660edc3dd66780050e751fc830262c1adaa61611ee799927b427c595c0ce5f96f6a893669a2bd18c8652e0870deabda5e14968c91395e34e18de059ad78cc
-
memory/1904-26-0x0000000077D50000-0x0000000077D51000-memory.dmpFilesize
4KB
-
memory/1904-0-0x0000000000320000-0x0000000000350000-memory.dmpFilesize
192KB
-
memory/1904-4-0x00000000002D0000-0x00000000002D1000-memory.dmpFilesize
4KB
-
memory/1904-6-0x0000000000350000-0x0000000000351000-memory.dmpFilesize
4KB
-
memory/1904-5-0x0000000077D4F000-0x0000000077D50000-memory.dmpFilesize
4KB
-
memory/1904-2-0x0000000000240000-0x0000000000242000-memory.dmpFilesize
8KB
-
memory/1904-7-0x0000000077D50000-0x0000000077D51000-memory.dmpFilesize
4KB
-
memory/1904-53-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1904-54-0x0000000077D4F000-0x0000000077D50000-memory.dmpFilesize
4KB
-
memory/1904-1-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/1904-69-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/2136-17-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2136-22-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2136-23-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2136-24-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2136-20-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2136-18-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2136-15-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2136-11-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2136-9-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2828-51-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-89-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-44-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-35-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-29-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-93-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-92-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-76-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-77-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-79-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-81-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-82-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-83-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-85-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-86-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-87-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-88-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-45-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-90-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2828-91-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/3052-75-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3052-73-0x00000000002F0000-0x00000000002F2000-memory.dmpFilesize
8KB
-
memory/3052-72-0x0000000000400000-0x00000000004B7000-memory.dmpFilesize
732KB
-
memory/3052-70-0x00000000002C0000-0x00000000002F0000-memory.dmpFilesize
192KB