77ef739cac52a749e996bcfdb3038410d007d980796cb69ca1e3cc552f64bd63

Analysis

max time kernel
150s
max time network
121s
platform
windows7_x64
resource
win7-20231215-en
resource tags

arch:x64arch:x86image:win7-20231215-enlocale:en-usos:windows7-x64system
submitted
12/02/2024, 09:20

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target

96cfb954ba0a68ccb609f5da78b5d8ce.exe
Size

316KB
MD5

96cfb954ba0a68ccb609f5da78b5d8ce
SHA1

436fc0c71f2d3848244796b4c097b8a81500c9e3
SHA256

77ef739cac52a749e996bcfdb3038410d007d980796cb69ca1e3cc552f64bd63
SHA512

cbae824c7e3533390b5e4556324d8d744266c1ce2e3c8195597dd26b5d5655f6bb50e2a0c1eadf50648665965613f7f2dfb00a2d0b9bbf79c1a51b5e14612b6e
SSDEEP

6144:aeMvfhDqiJQuJCU1Nf4nFe22Rr2154dyTdqF15JIzCXJKn3hczRvrvVgnj:EXJvD1NQczrnxF15JM2KnRkRvrNq

Score

7^/10

persistence

Malware Config

Signatures

Deletes itself 1 IoCs

pid	Process
2688	cmd.exe

Executes dropped EXE 2 IoCs

pid	Process
2700	_xx_explorer.exe
2676	_xx_explorer.exe

Loads dropped DLL 3 IoCs

pid	Process
2084	96cfb954ba0a68ccb609f5da78b5d8ce.exe
2084	96cfb954ba0a68ccb609f5da78b5d8ce.exe
2700	_xx_explorer.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3427588347-1492276948-3422228430-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupd.exe = "C:\\Users\\Admin\\AppData\\Local\\_xx_explorer.exe"	_xx_explorer.exe

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 2204 set thread context of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2700 set thread context of 2676	2700	_xx_explorer.exe	32

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe
2676	_xx_explorer.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe
2700	_xx_explorer.exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2204 wrote to memory of 2084	2204	96cfb954ba0a68ccb609f5da78b5d8ce.exe	28
PID 2084 wrote to memory of 2700	2084	96cfb954ba0a68ccb609f5da78b5d8ce.exe	29
PID 2084 wrote to memory of 2700	2084	96cfb954ba0a68ccb609f5da78b5d8ce.exe	29
PID 2084 wrote to memory of 2700	2084	96cfb954ba0a68ccb609f5da78b5d8ce.exe	29
PID 2084 wrote to memory of 2700	2084	96cfb954ba0a68ccb609f5da78b5d8ce.exe	29
PID 2084 wrote to memory of 2688	2084	96cfb954ba0a68ccb609f5da78b5d8ce.exe	31
PID 2084 wrote to memory of 2688	2084	96cfb954ba0a68ccb609f5da78b5d8ce.exe	31
PID 2084 wrote to memory of 2688	2084	96cfb954ba0a68ccb609f5da78b5d8ce.exe	31
PID 2084 wrote to memory of 2688	2084	96cfb954ba0a68ccb609f5da78b5d8ce.exe	31
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2700 wrote to memory of 2676	2700	_xx_explorer.exe	32
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18
PID 2676 wrote to memory of 1240	2676	_xx_explorer.exe	18

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1240
- C:\Users\Admin\AppData\Local\Temp\96cfb954ba0a68ccb609f5da78b5d8ce.exe
  "C:\Users\Admin\AppData\Local\Temp\96cfb954ba0a68ccb609f5da78b5d8ce.exe"
  2⤵
  - Suspicious use of SetThreadContext
  - Suspicious use of SetWindowsHookEx
  - Suspicious use of WriteProcessMemory
  PID:2204
- - C:\Users\Admin\AppData\Local\Temp\96cfb954ba0a68ccb609f5da78b5d8ce.exe
    "C:\Users\Admin\AppData\Local\Temp\96cfb954ba0a68ccb609f5da78b5d8ce.exe"
    3⤵
    - Loads dropped DLL
    - Suspicious use of WriteProcessMemory
    PID:2084
  - - C:\Users\Admin\AppData\Local\_xx_explorer.exe
      "C:\Users\Admin\AppData\Local\_xx_explorer.exe"
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Suspicious use of SetThreadContext
      Suspicious use of SetWindowsHookEx
      Suspicious use of WriteProcessMemory
      PID:2700
    - - C:\Users\Admin\AppData\Local\_xx_explorer.exe
        
        "C:\Users\Admin\AppData\Local\_xx_explorer.exe"
        5⤵
        Executes dropped EXE
        Adds Run key to start application
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of WriteProcessMemory
        
        PID:2676
  - - C:\Windows\SysWOW64\cmd.exe
      cmd /c ""C:\Users\Admin\AppData\Local\melt.bat" "
      4⤵
      Deletes itself
      PID:2688

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\melt.bat

Filesize
123B

MD5
9bbc9d90bdfc5a612e31320296d782de

SHA1
b9a8349dad60a1bdfe9a02455de3281d9b5233f8

SHA256
97751912c4ab4a1fb9a85d1b4390928540eb1a5634913fc1dc496177883db8fa

SHA512
0a67de1688f1f65dfa8025a852570a32fb9ec66702ead8922fdcc01c6cef04f04a518201103031aa5c62d8acee99bad91601699bd74d073a0569962070a6482c

Download Submit
C:\Users\Admin\AppData\Roaming\Microsoft\Crypto\RSA\S-1-5-21-3427588347-1492276948-3422228430-1000\699c4b9cdebca7aaea5193cae8a50098_d944c546-b3e1-4f8c-a2cd-c02cbd20099d

Filesize
50B

MD5
5b63d4dd8c04c88c0e30e494ec6a609a

SHA1
884d5a8bdc25fe794dc22ef9518009dcf0069d09

SHA256
4d93c22555b3169e5c13716ca59b8b22892c69b3025aea841afe5259698102fd

SHA512
15ff8551ac6b9de978050569bcdc26f44dfc06a0eaf445ac70fd45453a21bdafa3e4c8b4857d6a1c3226f4102a639682bdfb71d7b255062fb81a51c9126896cb

Download Submit
\Users\Admin\AppData\Local\_xx_explorer.exe

Filesize
316KB

MD5
96cfb954ba0a68ccb609f5da78b5d8ce

SHA1
436fc0c71f2d3848244796b4c097b8a81500c9e3

SHA256
77ef739cac52a749e996bcfdb3038410d007d980796cb69ca1e3cc552f64bd63

SHA512
cbae824c7e3533390b5e4556324d8d744266c1ce2e3c8195597dd26b5d5655f6bb50e2a0c1eadf50648665965613f7f2dfb00a2d0b9bbf79c1a51b5e14612b6e

Download Submit
memory/1240-69-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/1240-67-0x00000000021E0000-0x00000000021E1000-memory.dmp

Filesize
4KB

Download
memory/2084-10-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2084-35-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2084-14-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2084-12-0x000000007EFDE000-0x000000007EFDF000-memory.dmp

Filesize
4KB

Download
memory/2084-15-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2084-16-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2084-17-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2084-3-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2084-9-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2084-11-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2084-8-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2084-5-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2084-7-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2676-65-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2676-63-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2676-66-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2676-62-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download
memory/2676-345-0x0000000000400000-0x000000000044F000-memory.dmp

Filesize
316KB

Download