bf26cd337ff59f97c556e991ff2e75a1383c91311955ff14454dbfbc4f1bee37

General

Target

virus_v2.1_bug fix.exe
Size

155KB
MD5

4681ca2ba9bd15c3f49db5ec8e24ab85
SHA1

f7c02bb3bb4e2e3d98d2e2697653fe1debb12f10
SHA256

bf26cd337ff59f97c556e991ff2e75a1383c91311955ff14454dbfbc4f1bee37
SHA512

095ae8335c7903d043e1f094590909d4e7228311ab73c9a7a02d99f1367f73817f24b97ddefbe716961596c881df3bcedd7c0b8d03881021b3df6f004efae64f
SSDEEP

3072:DiFfHgTWmCRkGbKGLeNTBfTj6FY24wR+UIDBLCZ/o:G5aWbksiNTBbjsI

Score

7^/10

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
2576	virus_v2.1_bug fix.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%AppData%\Microsoft\Windows\Start Menu\Programs\Windows PowerShell\Windows PowerShell.lnk	PowerShell.exe

Modifies registry class 6 IoCs

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = ".txt"	cmd.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	7zFM.exe
Key created	\REGISTRY\USER\S-1-5-21-3270530367-132075249-2153716227-1000_Classes\Local Settings	OpenWith.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe\ = ".txt"	cmd.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\Classes\.exe	cmd.exe

Modifies registry key 1 TTPs 4 IoCs

Modify Registry

T1112

pid	Process
4964	reg.exe
4884	reg.exe
4528	reg.exe
376	reg.exe

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
3004	PowerShell.exe
3004	PowerShell.exe

Suspicious behavior: GetForegroundWindowSpam 1 IoCs

pid	Process
4732	7zFM.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeRestorePrivilege	4732	7zFM.exe
Token: 35	4732	7zFM.exe
Token: SeSecurityPrivilege	4732	7zFM.exe
Token: SeDebugPrivilege	3004	PowerShell.exe

Suspicious use of FindShellTrayWindow 3 IoCs

pid	Process
4732	7zFM.exe
4732	7zFM.exe
4732	7zFM.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1992	OpenWith.exe

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 4692 wrote to memory of 1092	4692	virus_v2.1_bug fix.exe	89
PID 4692 wrote to memory of 1092	4692	virus_v2.1_bug fix.exe	89
PID 1092 wrote to memory of 4964	1092	cmd.exe	93
PID 1092 wrote to memory of 4964	1092	cmd.exe	93
PID 1092 wrote to memory of 4884	1092	cmd.exe	94
PID 1092 wrote to memory of 4884	1092	cmd.exe	94
PID 3004 wrote to memory of 2576	3004	PowerShell.exe	124
PID 3004 wrote to memory of 2576	3004	PowerShell.exe	124
PID 3004 wrote to memory of 2576	3004	PowerShell.exe	124
PID 2576 wrote to memory of 1712	2576	virus_v2.1_bug fix.exe	125
PID 2576 wrote to memory of 1712	2576	virus_v2.1_bug fix.exe	125
PID 1712 wrote to memory of 4528	1712	cmd.exe	130
PID 1712 wrote to memory of 4528	1712	cmd.exe	130
PID 1712 wrote to memory of 376	1712	cmd.exe	131
PID 1712 wrote to memory of 376	1712	cmd.exe	131

C:\Users\Admin\AppData\Local\Temp\virus_v2.1_bug fix.exe
"C:\Users\Admin\AppData\Local\Temp\virus_v2.1_bug fix.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:4692
- C:\Windows\system32\cmd.exe
  "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\37F8.tmp\37F9.tmp\37FA.bat "C:\Users\Admin\AppData\Local\Temp\virus_v2.1_bug fix.exe""
  2⤵
  - Modifies registry class
  - Suspicious use of WriteProcessMemory
  PID:1092
- - C:\Windows\system32\reg.exe
    reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun /v 1 /t REG_DWORD /d C:\Windows\explorer.exe /f
    3⤵
    - Modifies registry key
    PID:4964
- - C:\Windows\system32\reg.exe
    reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f
    3⤵
    - Modifies registry key
    PID:4884

C:\Windows\System32\rundll32.exe
C:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding
1⤵
PID:2964

C:\Program Files\7-Zip\7zFM.exe
"C:\Program Files\7-Zip\7zFM.exe" "C:\Users\Admin\AppData\Local\Temp\virus_v2.1_bug fix.exe"
1⤵
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:4732

C:\Windows\system32\OpenWith.exe
C:\Windows\system32\OpenWith.exe -Embedding
1⤵
- Modifies registry class
- Suspicious use of SetWindowsHookEx
PID:1992

C:\Windows\system32\WindowsPowerShell\v1.0\PowerShell.exe
"PowerShell.exe" -noexit -command Set-Location -literalPath 'C:\Users\Admin\AppData\Local\Temp'
1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3004
- C:\Users\Admin\AppData\Local\Temp\virus_v2.1_bug fix.exe
  "C:\Users\Admin\AppData\Local\Temp\virus_v2.1_bug fix.exe"
  2⤵
  - Executes dropped EXE
  - Suspicious use of WriteProcessMemory
  PID:2576
- - C:\Windows\system32\cmd.exe
    "C:\Windows\sysnative\cmd" /c "C:\Users\Admin\AppData\Local\Temp\43F5.tmp\43F6.tmp\43F7.bat "C:\Users\Admin\AppData\Local\Temp\virus_v2.1_bug fix.exe""
    3⤵
    - Modifies registry class
    - Suspicious use of WriteProcessMemory
    PID:1712
  - - C:\Windows\system32\reg.exe
      reg add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\Explorer\RestrictRun /v 1 /t REG_DWORD /d C:\Windows\explorer.exe /f
      4⤵
      Modifies registry key
      PID:4528
  - - C:\Windows\system32\reg.exe
      reg add HKCUSoftwareMicrosoftWindowsCurrentVersionPoliciesSystem /v DisableTaskMgr /t REG_DWORD /d 1 /f
      4⤵
      Modifies registry key
      PID:376

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

1

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\37F8.tmp\37F9.tmp\37FA.bat

Filesize
850B

MD5
56045ef1418cfe9e3d9befd7221f52bf

SHA1
e94340866c0af50e44e5391bb2f8a820e31cb1df

SHA256
04039ca73bf802c114f69e40bc4f044a0b63022490c384c746dcb07d2db18d46

SHA512
f8df332930d1b4d93951e731de0a85206e2a147c1c1aa5eeb17437a318ad4ff8457733fdb49f308cd15a0732ff7019467d9123908601dcd19c10f2767704baf9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_yodyclru.bxd.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\virus_v2.1_bug fix.exe

Filesize
155KB

MD5
4681ca2ba9bd15c3f49db5ec8e24ab85

SHA1
f7c02bb3bb4e2e3d98d2e2697653fe1debb12f10

SHA256
bf26cd337ff59f97c556e991ff2e75a1383c91311955ff14454dbfbc4f1bee37

SHA512
095ae8335c7903d043e1f094590909d4e7228311ab73c9a7a02d99f1367f73817f24b97ddefbe716961596c881df3bcedd7c0b8d03881021b3df6f004efae64f

Download Submit
memory/3004-12-0x0000016711E00000-0x0000016711E22000-memory.dmp

Filesize
136KB

Download
memory/3004-17-0x00007FFA690B0000-0x00007FFA69B71000-memory.dmp

Filesize
10.8MB

Download
memory/3004-19-0x0000016711860000-0x0000016711870000-memory.dmp

Filesize
64KB

Download
memory/3004-18-0x0000016711860000-0x0000016711870000-memory.dmp

Filesize
64KB

Download
memory/3004-20-0x000001672AD60000-0x000001672ADA4000-memory.dmp

Filesize
272KB

Download
memory/3004-21-0x000001672AE30000-0x000001672AEA6000-memory.dmp

Filesize
472KB

Download
memory/3004-27-0x00007FFA690B0000-0x00007FFA69B71000-memory.dmp

Filesize
10.8MB

Download
memory/3004-28-0x0000016711860000-0x0000016711870000-memory.dmp

Filesize
64KB

Download

Resubmissions

Analysis

Sharing