Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
14/02/2024, 05:16
Static task
static1
Behavioral task
behavioral1
Sample
9ad92144516618480fb1deeed0fe3cb4.exe
Resource
win7-20231215-en
windows7-x64
Behavioral task
behavioral2
Sample
9ad92144516618480fb1deeed0fe3cb4.exe
Resource
win10v2004-20231222-en
windows10-2004-x64
General
-
Target
9ad92144516618480fb1deeed0fe3cb4.exe
-
Size
8KB
-
MD5
9ad92144516618480fb1deeed0fe3cb4
-
SHA1
65bb4166fb3701804287c53d7b9d4238c38efcd6
-
SHA256
605b0c05b321ec9ef7c068d2c59bfda325eedc7e07ab149fcb28e7aa9712b13b
-
SHA512
47601933aa05de85581c00ed6429761e61e8d72a1e7fa5effc07c25c5da903e8e93b794d59e9cfc5b4b5d0cc54e36e94af8673ae3fe5e631e6d630e076ad7b0a
-
SSDEEP
192:4ykNslHnUh+6qQ0rKt9KZ6YSxDR53ebjslP1oyR1c:LkNslHa+RzwDDR5ubju1v+
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
pid Process 1164 chksrv.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3803511929-1339359695-2191195476-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\office = "c:\\users\\admin\\appdata\\local\\chksrv.exe" 9ad92144516618480fb1deeed0fe3cb4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1464 9ad92144516618480fb1deeed0fe3cb4.exe 1464 9ad92144516618480fb1deeed0fe3cb4.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe 1164 chksrv.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 1464 9ad92144516618480fb1deeed0fe3cb4.exe Token: SeDebugPrivilege 1164 chksrv.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 1464 wrote to memory of 1164 1464 9ad92144516618480fb1deeed0fe3cb4.exe 85 PID 1464 wrote to memory of 1164 1464 9ad92144516618480fb1deeed0fe3cb4.exe 85 PID 1464 wrote to memory of 1164 1464 9ad92144516618480fb1deeed0fe3cb4.exe 85 PID 1464 wrote to memory of 2776 1464 9ad92144516618480fb1deeed0fe3cb4.exe 86 PID 1464 wrote to memory of 2776 1464 9ad92144516618480fb1deeed0fe3cb4.exe 86 PID 1464 wrote to memory of 2776 1464 9ad92144516618480fb1deeed0fe3cb4.exe 86
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ad92144516618480fb1deeed0fe3cb4.exe"C:\Users\Admin\AppData\Local\Temp\9ad92144516618480fb1deeed0fe3cb4.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1464 -
\??\c:\users\admin\appdata\local\chksrv.exec:\users\admin\appdata\local\chksrv.exe2⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1164
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c del C:\Users\Admin\AppData\Local\Temp\9AD921~1.EXE > nul2⤵PID:2776
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8KB
MD59ad92144516618480fb1deeed0fe3cb4
SHA165bb4166fb3701804287c53d7b9d4238c38efcd6
SHA256605b0c05b321ec9ef7c068d2c59bfda325eedc7e07ab149fcb28e7aa9712b13b
SHA51247601933aa05de85581c00ed6429761e61e8d72a1e7fa5effc07c25c5da903e8e93b794d59e9cfc5b4b5d0cc54e36e94af8673ae3fe5e631e6d630e076ad7b0a