863b68913ac806bdef51e42f5e9f1328e7e89d44f6d9ee0932fa31899e32be61

Analysis

max time kernel
143s
max time network
147s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
11/03/2024, 02:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

bf982c03d7bd53fc8d226c663130804c.exe
Size

34KB
MD5

bf982c03d7bd53fc8d226c663130804c
SHA1

8c61be7ea615be3d706964d468f562a06b5ade44
SHA256

863b68913ac806bdef51e42f5e9f1328e7e89d44f6d9ee0932fa31899e32be61
SHA512

f9d7d70a67bc4d1caa2f427cfa3fed74ce4bdebc1d24c3775940bb55eccac783274b079d89d65365143092caf5f2ead3b737d59f15a0a76d416fc1e1da412978
SSDEEP

768:l1MO6kHpnF/v3OOKN4ntqgGqQcHUoGcsVpgcrZ9X3:DN1b3M4nQcZGlg29X

Score

8^/10

persistence

Malware Config

Signatures

Sets file execution options in registry 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe	bf982c03d7bd53fc8d226c663130804c.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\egui.exe\Debugger = "services.exe"	bf982c03d7bd53fc8d226c663130804c.exe

Executes dropped EXE 1 IoCs

pid	Process
2432	~f76acc8.tmp

Loads dropped DLL 2 IoCs

pid	Process
1152	bf982c03d7bd53fc8d226c663130804c.exe
1152	bf982c03d7bd53fc8d226c663130804c.exe

Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).

System Information Discovery
T1082

Kills process with taskkill 2 IoCs

evasion

pid	Process
2224	taskkill.exe
1676	taskkill.exe

Suspicious behavior: EnumeratesProcesses 7 IoCs

pid	Process
1152	bf982c03d7bd53fc8d226c663130804c.exe
1152	bf982c03d7bd53fc8d226c663130804c.exe
1152	bf982c03d7bd53fc8d226c663130804c.exe
1152	bf982c03d7bd53fc8d226c663130804c.exe
2432	~f76acc8.tmp
2432	~f76acc8.tmp
2432	~f76acc8.tmp

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
468	Process not Found

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	2224	taskkill.exe
Token: SeDebugPrivilege	1676	taskkill.exe
Token: SeDebugPrivilege	1152	bf982c03d7bd53fc8d226c663130804c.exe

Suspicious use of WriteProcessMemory 12 IoCs

description	pid	Process	procid_target
PID 1152 wrote to memory of 2224	1152	bf982c03d7bd53fc8d226c663130804c.exe	28
PID 1152 wrote to memory of 2224	1152	bf982c03d7bd53fc8d226c663130804c.exe	28
PID 1152 wrote to memory of 2224	1152	bf982c03d7bd53fc8d226c663130804c.exe	28
PID 1152 wrote to memory of 2224	1152	bf982c03d7bd53fc8d226c663130804c.exe	28
PID 1152 wrote to memory of 1676	1152	bf982c03d7bd53fc8d226c663130804c.exe	31
PID 1152 wrote to memory of 1676	1152	bf982c03d7bd53fc8d226c663130804c.exe	31
PID 1152 wrote to memory of 1676	1152	bf982c03d7bd53fc8d226c663130804c.exe	31
PID 1152 wrote to memory of 1676	1152	bf982c03d7bd53fc8d226c663130804c.exe	31
PID 1152 wrote to memory of 2432	1152	bf982c03d7bd53fc8d226c663130804c.exe	35
PID 1152 wrote to memory of 2432	1152	bf982c03d7bd53fc8d226c663130804c.exe	35
PID 1152 wrote to memory of 2432	1152	bf982c03d7bd53fc8d226c663130804c.exe	35
PID 1152 wrote to memory of 2432	1152	bf982c03d7bd53fc8d226c663130804c.exe	35

C:\Users\Admin\AppData\Local\Temp\bf982c03d7bd53fc8d226c663130804c.exe
"C:\Users\Admin\AppData\Local\Temp\bf982c03d7bd53fc8d226c663130804c.exe"
1⤵
- Sets file execution options in registry
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1152
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im ekrn.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:2224
- C:\Windows\SysWOW64\taskkill.exe
  "C:\Windows\System32\taskkill.exe" /f /im egui.exe
  2⤵
  - Kills process with taskkill
  - Suspicious use of AdjustPrivilegeToken
  PID:1676
- C:\Users\Admin\AppData\Local\Temp\~f76acc8.tmp
  C:\Users\Admin\AppData\Local\Temp\~f76acc8.tmp
  2⤵
  - Executes dropped EXE
  - Suspicious behavior: EnumeratesProcesses
  PID:2432

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

\Users\Admin\AppData\Local\Temp\~f76acc8.tmp

Filesize
6KB

MD5
2160060127cace2e74d51fad2705337d

SHA1
fe7147338fa3bdf00839f2104c0d81c4f36b4b2b

SHA256
ae32dc99701dcea97cd61e8a7a9060a93597130fcf2625a43c07e1192b40ecd2

SHA512
174d7e2334d97afffe7bcc1d17e365e7403d0df8758b3ae29e364f937d3feb6a0fa318a9e741055bb0f990fdd0c8c8c0f8fb76b885394f2ff7dedd0c7a7a8232

Download Submit