Analysis
-
max time kernel
141s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
25-03-2024 05:31
Static task
static1
Behavioral task
behavioral1
Sample
dd5a2240e909613b9ca8c83cfa9ea6c5.exe
Resource
win7-20240221-en
General
-
Target
dd5a2240e909613b9ca8c83cfa9ea6c5.exe
-
Size
279KB
-
MD5
dd5a2240e909613b9ca8c83cfa9ea6c5
-
SHA1
83891b22ce8b041b80e591552445d3b5d66fea34
-
SHA256
932a76e68ea3af0b08b86d1cec01ff34038fe76cccb81dc3d2a9da15c239fd99
-
SHA512
73db4206f9a50663c3d0988daa5dd16648ff88bcf8437a5f1a3c8e52accadffa82a11d05afa90a83c53998d252624d3937ee2244c6652717a1095a266b201aff
-
SSDEEP
6144:u7Oo0l65RAHqjeEnoz5OEKS64y5eUSqX5kdpfkQr7ZBfE9M:u7tRGgdoz5LDsOddkUBc9M
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
dd5a2240e909613b9ca8c83cfa9ea6c5.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" dd5a2240e909613b9ca8c83cfa9ea6c5.exe -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
D49D.tmppid process 2520 D49D.tmp -
Loads dropped DLL 2 IoCs
Processes:
dd5a2240e909613b9ca8c83cfa9ea6c5.exepid process 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/2684-1-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2684-33-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2196-39-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2684-41-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2684-101-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1868-137-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2196-231-0x0000000000640000-0x0000000000740000-memory.dmp upx behavioral1/memory/2684-235-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2684-241-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
dd5a2240e909613b9ca8c83cfa9ea6c5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\D11.exe = "C:\\Program Files (x86)\\LP\\6294\\D11.exe" dd5a2240e909613b9ca8c83cfa9ea6c5.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
Processes:
dd5a2240e909613b9ca8c83cfa9ea6c5.exedescription ioc process File opened for modification C:\Program Files (x86)\LP\6294\D11.exe dd5a2240e909613b9ca8c83cfa9ea6c5.exe File created C:\Program Files (x86)\LP\6294\D11.exe dd5a2240e909613b9ca8c83cfa9ea6c5.exe File opened for modification C:\Program Files (x86)\LP\6294\D49D.tmp dd5a2240e909613b9ca8c83cfa9ea6c5.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-406356229-2805545415-1236085040-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
dd5a2240e909613b9ca8c83cfa9ea6c5.exepid process 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 568 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
msiexec.exeexplorer.exedescription pid process Token: SeRestorePrivilege 2616 msiexec.exe Token: SeTakeOwnershipPrivilege 2616 msiexec.exe Token: SeSecurityPrivilege 2616 msiexec.exe Token: SeShutdownPrivilege 568 explorer.exe Token: SeShutdownPrivilege 568 explorer.exe Token: SeShutdownPrivilege 568 explorer.exe Token: SeShutdownPrivilege 568 explorer.exe Token: SeShutdownPrivilege 568 explorer.exe Token: SeShutdownPrivilege 568 explorer.exe Token: SeShutdownPrivilege 568 explorer.exe Token: SeShutdownPrivilege 568 explorer.exe Token: SeShutdownPrivilege 568 explorer.exe Token: SeShutdownPrivilege 568 explorer.exe Token: SeShutdownPrivilege 568 explorer.exe Token: SeShutdownPrivilege 568 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
explorer.exepid process 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
Processes:
explorer.exepid process 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe 568 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
dd5a2240e909613b9ca8c83cfa9ea6c5.exedescription pid process target process PID 2684 wrote to memory of 2196 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe dd5a2240e909613b9ca8c83cfa9ea6c5.exe PID 2684 wrote to memory of 2196 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe dd5a2240e909613b9ca8c83cfa9ea6c5.exe PID 2684 wrote to memory of 2196 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe dd5a2240e909613b9ca8c83cfa9ea6c5.exe PID 2684 wrote to memory of 2196 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe dd5a2240e909613b9ca8c83cfa9ea6c5.exe PID 2684 wrote to memory of 1868 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe dd5a2240e909613b9ca8c83cfa9ea6c5.exe PID 2684 wrote to memory of 1868 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe dd5a2240e909613b9ca8c83cfa9ea6c5.exe PID 2684 wrote to memory of 1868 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe dd5a2240e909613b9ca8c83cfa9ea6c5.exe PID 2684 wrote to memory of 1868 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe dd5a2240e909613b9ca8c83cfa9ea6c5.exe PID 2684 wrote to memory of 2520 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe D49D.tmp PID 2684 wrote to memory of 2520 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe D49D.tmp PID 2684 wrote to memory of 2520 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe D49D.tmp PID 2684 wrote to memory of 2520 2684 dd5a2240e909613b9ca8c83cfa9ea6c5.exe D49D.tmp -
System policy modification 1 TTPs 2 IoCs
Processes:
dd5a2240e909613b9ca8c83cfa9ea6c5.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer dd5a2240e909613b9ca8c83cfa9ea6c5.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" dd5a2240e909613b9ca8c83cfa9ea6c5.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\dd5a2240e909613b9ca8c83cfa9ea6c5.exe"C:\Users\Admin\AppData\Local\Temp\dd5a2240e909613b9ca8c83cfa9ea6c5.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\dd5a2240e909613b9ca8c83cfa9ea6c5.exeC:\Users\Admin\AppData\Local\Temp\dd5a2240e909613b9ca8c83cfa9ea6c5.exe startC:\Users\Admin\AppData\Roaming\45051\CD662.exe%C:\Users\Admin\AppData\Roaming\450512⤵
-
C:\Users\Admin\AppData\Local\Temp\dd5a2240e909613b9ca8c83cfa9ea6c5.exeC:\Users\Admin\AppData\Local\Temp\dd5a2240e909613b9ca8c83cfa9ea6c5.exe startC:\Program Files (x86)\515AC\lvvm.exe%C:\Program Files (x86)\515AC2⤵
-
C:\Program Files (x86)\LP\6294\D49D.tmp"C:\Program Files (x86)\LP\6294\D49D.tmp"2⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\45051\15AC.505Filesize
996B
MD523c3a213270b4a88e5ff14cc7d223be4
SHA1c7139842b6b0fcc041a0139ea552dd7bd81e5fdd
SHA25659bddbeb7e21ac28f109b7b22a45e5f8affc76abb8c48bbaede495e3fc748c7d
SHA512696263f97a52309cc2b2ef86e8e62cd1918d5abbe7741e1491f46af099f3b43242b02889f49f4901cafd426c48bfed59b7a9c2b988e0684b01db306c6ec35cd7
-
C:\Users\Admin\AppData\Roaming\45051\15AC.505Filesize
1KB
MD5a2d2d743a404db7790d2221bdf6fb76d
SHA1fd9525f851d651dc970e3b9539eda668a3c53d83
SHA2561cacffa7919f35bfcd3dbc4c75bbe1f80e74314e55126c2cecfd51efa517b993
SHA5126fd62cace6afac89d409e601634b63a0c86f1a9d31e3d5eedb584af287d1b9757765ae4a9b4dd246c495d7aeda437988e434d5e6d97d567d57409c76b8cf7af4
-
C:\Users\Admin\AppData\Roaming\45051\15AC.505Filesize
600B
MD56655580226c2fa5338ff7f6b27ccdb40
SHA10f655fcb04b66a2f0f343cf98e9e67f724a1f004
SHA25688b8a07b2d1f77e0a32d3f2cbf880bb5dc63757b6dc3f404ebbafeee2b8cd8b7
SHA5125a65ef228a7f063c5bbcff4a14bc408ff5234737d3e2284fe8eeb92bfe675d110c4def4647731a0e6eb81b751d55fb86e5d21950abcd0bb05a2b75107845c781
-
C:\Users\Admin\AppData\Roaming\45051\15AC.505Filesize
300B
MD5a94ad4fef5858945d64717bfd34d3398
SHA1459a8eb4fa0a2b96c8929858ae60ea7a57a1e993
SHA256991825f51da497d9e61fa5676c1b0b91eafdd6153c26cfa2082562dc9f9262a7
SHA512b5e52e4451a0a7da55ce3a0eeb8621e384882e61432f27c3a772fd835de231619bd1fc196e4a8de0c415f648a3bfc9d60faa1cd7f02dce046422e94e2a10e11b
-
\Program Files (x86)\LP\6294\D49D.tmpFilesize
99KB
MD5cb853d0e676be7b23903aa89175d8d69
SHA12066462d42c45133df60c5e5f9e8956373d191b0
SHA2567291b34528651c542a4e09036bb828f27c9f75c134d2be3aed3e1c5a0db5fe20
SHA512bf96f4c8511929ef380562004211a72821330465538db6da3367cbce387092384265e0bfd4ab54e62b742d68d668ff1457f43381d7a770fd3027f3bab1f36038
-
memory/568-238-0x0000000004310000-0x0000000004311000-memory.dmpFilesize
4KB
-
memory/568-140-0x0000000004310000-0x0000000004311000-memory.dmpFilesize
4KB
-
memory/1868-138-0x0000000001E90000-0x0000000001ED7000-memory.dmpFilesize
284KB
-
memory/1868-137-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2196-39-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2196-40-0x0000000000640000-0x0000000000740000-memory.dmpFilesize
1024KB
-
memory/2196-231-0x0000000000640000-0x0000000000740000-memory.dmpFilesize
1024KB
-
memory/2520-233-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2520-234-0x00000000004D0000-0x00000000005D0000-memory.dmpFilesize
1024KB
-
memory/2520-236-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/2684-33-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2684-2-0x0000000001F50000-0x0000000002050000-memory.dmpFilesize
1024KB
-
memory/2684-1-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2684-102-0x0000000001F50000-0x0000000002050000-memory.dmpFilesize
1024KB
-
memory/2684-101-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2684-235-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2684-41-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2684-241-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB