Analysis
-
max time kernel
147s -
max time network
147s -
platform
windows7_x64 -
resource
win7-20240220-en -
resource tags
arch:x64arch:x86image:win7-20240220-enlocale:en-usos:windows7-x64system -
submitted
15-03-2024 22:12
Static task
static1
Behavioral task
behavioral1
Sample
c5d113e1f4e719d4298bae662ff1eb07.exe
Resource
win7-20240220-en
General
-
Target
c5d113e1f4e719d4298bae662ff1eb07.exe
-
Size
583KB
-
MD5
c5d113e1f4e719d4298bae662ff1eb07
-
SHA1
23fdaa69f26986ca548d02f910495785d4790798
-
SHA256
91e3a85c7f25297f921a6b0927998aea5085a5f9d09a8945360afb03bf60cf20
-
SHA512
b1d2666c56f4168141164831de8b65c049e3bcc0dcb185fb4b3572d745f24ee92fad66bb8d40fa20a3fa9d9d086a55f34d7ef3b682771d2625bf7c86b1fc0ef4
-
SSDEEP
12288:v4aHAKg35BTIdTeB1/TVLIbunEplJyH8FUxcjolbPP/czodz75Dj:1g35WA/pIbbJdwbPP/E4
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SvchostReader.qitdbjed.lnk c5d113e1f4e719d4298bae662ff1eb07.exe -
Executes dropped EXE 2 IoCs
pid Process 2700 SvchostReader.exe 2792 SvchostReader.exe -
Loads dropped DLL 2 IoCs
pid Process 2276 c5d113e1f4e719d4298bae662ff1eb07.exe 2276 c5d113e1f4e719d4298bae662ff1eb07.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2700 set thread context of 2792 2700 SvchostReader.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 2700 SvchostReader.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
description pid Process Token: SeDebugPrivilege 2276 c5d113e1f4e719d4298bae662ff1eb07.exe Token: SeDebugPrivilege 2700 SvchostReader.exe Token: SeDebugPrivilege 2792 SvchostReader.exe Token: 33 2792 SvchostReader.exe Token: SeIncBasePriorityPrivilege 2792 SvchostReader.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 2276 c5d113e1f4e719d4298bae662ff1eb07.exe -
Suspicious use of SendNotifyMessage 1 IoCs
pid Process 2276 c5d113e1f4e719d4298bae662ff1eb07.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 2792 SvchostReader.exe -
Suspicious use of WriteProcessMemory 13 IoCs
description pid Process procid_target PID 2276 wrote to memory of 2700 2276 c5d113e1f4e719d4298bae662ff1eb07.exe 30 PID 2276 wrote to memory of 2700 2276 c5d113e1f4e719d4298bae662ff1eb07.exe 30 PID 2276 wrote to memory of 2700 2276 c5d113e1f4e719d4298bae662ff1eb07.exe 30 PID 2276 wrote to memory of 2700 2276 c5d113e1f4e719d4298bae662ff1eb07.exe 30 PID 2700 wrote to memory of 2792 2700 SvchostReader.exe 31 PID 2700 wrote to memory of 2792 2700 SvchostReader.exe 31 PID 2700 wrote to memory of 2792 2700 SvchostReader.exe 31 PID 2700 wrote to memory of 2792 2700 SvchostReader.exe 31 PID 2700 wrote to memory of 2792 2700 SvchostReader.exe 31 PID 2700 wrote to memory of 2792 2700 SvchostReader.exe 31 PID 2700 wrote to memory of 2792 2700 SvchostReader.exe 31 PID 2700 wrote to memory of 2792 2700 SvchostReader.exe 31 PID 2700 wrote to memory of 2792 2700 SvchostReader.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\c5d113e1f4e719d4298bae662ff1eb07.exe"C:\Users\Admin\AppData\Local\Temp\c5d113e1f4e719d4298bae662ff1eb07.exe"1⤵
- Drops startup file
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
PID:2276 -
C:\Users\Admin\AppData\Local\SvchostReader.exe"C:\Users\Admin\AppData\Local\SvchostReader.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2700 -
C:\Users\Admin\AppData\Local\SvchostReader.exe"C:\Users\Admin\AppData\Local\SvchostReader.exe"3⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2792
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:684
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
128KB
MD52faded45147b1747b2763109bf611f8b
SHA19ad063591119666bca63aefb35c141e611656136
SHA256b3eebe4f3dc1593477e5b161b6473f679a2fea1750b360e259435240b992184c
SHA512249853cfb2be25f8a410c5cbf64649d07ecaf127349b4da50bd604ff86b53189d403c8e5c378cb107259a9c8b7f5ddeb38b27bf6e2abdf43e4d34b93619c18dc
-
Filesize
583KB
MD5c5d113e1f4e719d4298bae662ff1eb07
SHA123fdaa69f26986ca548d02f910495785d4790798
SHA25691e3a85c7f25297f921a6b0927998aea5085a5f9d09a8945360afb03bf60cf20
SHA512b1d2666c56f4168141164831de8b65c049e3bcc0dcb185fb4b3572d745f24ee92fad66bb8d40fa20a3fa9d9d086a55f34d7ef3b682771d2625bf7c86b1fc0ef4