Analysis
-
max time kernel
149s -
max time network
143s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
26-02-2024 10:35
Static task
static1
Behavioral task
behavioral1
Sample
a6243d6db924f3a1b34cafc3b9bc5163.exe
Resource
win7-20240220-en
General
-
Target
a6243d6db924f3a1b34cafc3b9bc5163.exe
-
Size
99KB
-
MD5
a6243d6db924f3a1b34cafc3b9bc5163
-
SHA1
5b4e9109876c1129813f52365344ca54dc77a3aa
-
SHA256
c88a8f4362929f801e4de2e9a056c0d81f09bd4545217be34786783f8316f28c
-
SHA512
8abfe25c4c761b096f5f4f4697331284fa2c4aca40330831a5c43498c467955ee7f8e8b15b5bfbf73ed0b3ab70fe571d464ef4e659ced2229d891cedddc7fcd9
-
SSDEEP
3072:TCuvo0N7CdRp1wHa8tORcXChoqGVk8jwaaHw7Koj4rDM+l7:OuvZgnp1A9WcXuDR
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Users\\Admin\\AppData\\Local\\aqwjjxbr\\iwoytxki.exe" svchost.exe -
Processes:
svchost.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" svchost.exe -
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
Processes:
svchost.exedescription ioc process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion svchost.exe -
Drops startup file 2 IoCs
Processes:
svchost.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iwoytxki.exe svchost.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\iwoytxki.exe svchost.exe -
Executes dropped EXE 1 IoCs
Processes:
acmtvamoffvhussq.exepid process 2556 acmtvamoffvhussq.exe -
Loads dropped DLL 5 IoCs
Processes:
a6243d6db924f3a1b34cafc3b9bc5163.exepid process 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2721934792-624042501-2768869379-1000\Software\Microsoft\Windows\CurrentVersion\Run\IwoYtxki = "C:\\Users\\Admin\\AppData\\Local\\aqwjjxbr\\iwoytxki.exe" svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
svchost.exepid process 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe 2756 svchost.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
pid process 476 -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
a6243d6db924f3a1b34cafc3b9bc5163.exesvchost.exesvchost.exeacmtvamoffvhussq.exedescription pid process Token: SeSecurityPrivilege 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe Token: SeDebugPrivilege 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe Token: SeSecurityPrivilege 2572 svchost.exe Token: SeSecurityPrivilege 2756 svchost.exe Token: SeDebugPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeSecurityPrivilege 2556 acmtvamoffvhussq.exe Token: SeLoadDriverPrivilege 2556 acmtvamoffvhussq.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe Token: SeBackupPrivilege 2756 svchost.exe Token: SeRestorePrivilege 2756 svchost.exe -
Suspicious use of WriteProcessMemory 24 IoCs
Processes:
a6243d6db924f3a1b34cafc3b9bc5163.exedescription pid process target process PID 2192 wrote to memory of 2572 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2572 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2572 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2572 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2572 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2572 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2572 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2572 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2572 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2572 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2756 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2756 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2756 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2756 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2756 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2756 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2756 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2756 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2756 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2756 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe svchost.exe PID 2192 wrote to memory of 2556 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe acmtvamoffvhussq.exe PID 2192 wrote to memory of 2556 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe acmtvamoffvhussq.exe PID 2192 wrote to memory of 2556 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe acmtvamoffvhussq.exe PID 2192 wrote to memory of 2556 2192 a6243d6db924f3a1b34cafc3b9bc5163.exe acmtvamoffvhussq.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a6243d6db924f3a1b34cafc3b9bc5163.exe"C:\Users\Admin\AppData\Local\Temp\a6243d6db924f3a1b34cafc3b9bc5163.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\SysWOW64\svchost.exeC:\Windows\system32\svchost.exe2⤵
- Modifies WinLogon for persistence
- UAC bypass
- Checks BIOS information in registry
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
C:\Users\Admin\AppData\Local\Temp\acmtvamoffvhussq.exe"C:\Users\Admin\AppData\Local\Temp\acmtvamoffvhussq.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Abuse Elevation Control Mechanism
1Bypass User Account Control
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\aqwjjxbr\iwoytxki.exeFilesize
99KB
MD5a6243d6db924f3a1b34cafc3b9bc5163
SHA15b4e9109876c1129813f52365344ca54dc77a3aa
SHA256c88a8f4362929f801e4de2e9a056c0d81f09bd4545217be34786783f8316f28c
SHA5128abfe25c4c761b096f5f4f4697331284fa2c4aca40330831a5c43498c467955ee7f8e8b15b5bfbf73ed0b3ab70fe571d464ef4e659ced2229d891cedddc7fcd9
-
memory/2192-0-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/2192-76-0x0000000002BE0000-0x0000000002C1B000-memory.dmpFilesize
236KB
-
memory/2192-7-0x00000000002B0000-0x00000000002B1000-memory.dmpFilesize
4KB
-
memory/2192-6-0x00000000774FF000-0x0000000077500000-memory.dmpFilesize
4KB
-
memory/2192-53-0x0000000077500000-0x0000000077501000-memory.dmpFilesize
4KB
-
memory/2192-1-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/2192-5-0x00000000002A0000-0x00000000002A1000-memory.dmpFilesize
4KB
-
memory/2192-8-0x0000000077500000-0x0000000077501000-memory.dmpFilesize
4KB
-
memory/2192-2-0x0000000000250000-0x0000000000252000-memory.dmpFilesize
8KB
-
memory/2192-63-0x0000000002BE0000-0x0000000002C1B000-memory.dmpFilesize
236KB
-
memory/2192-54-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/2192-3-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/2192-72-0x0000000002BE0000-0x0000000002C1B000-memory.dmpFilesize
236KB
-
memory/2192-57-0x00000000774FF000-0x0000000077500000-memory.dmpFilesize
4KB
-
memory/2556-80-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/2556-78-0x0000000000400000-0x000000000043A578-memory.dmpFilesize
233KB
-
memory/2572-20-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2572-22-0x0000000000060000-0x0000000000061000-memory.dmpFilesize
4KB
-
memory/2572-10-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2572-12-0x0000000000050000-0x0000000000051000-memory.dmpFilesize
4KB
-
memory/2572-16-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2572-18-0x0000000000070000-0x0000000000071000-memory.dmpFilesize
4KB
-
memory/2572-25-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2572-24-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2572-23-0x0000000020010000-0x000000002001C000-memory.dmpFilesize
48KB
-
memory/2756-84-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-88-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-45-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-44-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-29-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-81-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-82-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-83-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-35-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-86-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-87-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-51-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-89-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-90-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-91-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-92-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-93-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-94-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-95-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-96-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-97-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-98-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-99-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB
-
memory/2756-100-0x0000000020010000-0x000000002002C000-memory.dmpFilesize
112KB