Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
26-03-2024 14:50
Static task
static1
Behavioral task
behavioral1
Sample
df6d4fb5b398bc1051f5a5914d7e41b6.exe
Resource
win7-20240221-en
General
-
Target
df6d4fb5b398bc1051f5a5914d7e41b6.exe
-
Size
279KB
-
MD5
df6d4fb5b398bc1051f5a5914d7e41b6
-
SHA1
8055da8133ae2398edafd675bac8f5315dabbeba
-
SHA256
dee566569bb0f7ecb40d8148fe88e4643cfecd03fcf796866fe1cd582e023bc1
-
SHA512
61d0ce8421eb620122790d3124e231954d88cb270c54369d5d77cc135c448f9d8ca3c409ed66d47e9aecd9c25af85e2526401ab1f11260f56f919426b7fac54c
-
SSDEEP
6144:J7nr+l65RAHqjeEnozHOEKS64yoRHfmTj8UiUDTQv:J7XRGgdozHLDLRH+NXk
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" df6d4fb5b398bc1051f5a5914d7e41b6.exe -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
BE3.tmppid process 1304 BE3.tmp -
Loads dropped DLL 2 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exepid process 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1368-7-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2636-13-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1368-15-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1848-109-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1848-108-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1368-107-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1368-199-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1368-207-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\A5A.exe = "C:\\Program Files (x86)\\LP\\2FD8\\A5A.exe" df6d4fb5b398bc1051f5a5914d7e41b6.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exedescription ioc process File created C:\Program Files (x86)\LP\2FD8\A5A.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe File opened for modification C:\Program Files (x86)\LP\2FD8\BE3.tmp df6d4fb5b398bc1051f5a5914d7e41b6.exe File opened for modification C:\Program Files (x86)\LP\2FD8\A5A.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exepid process 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 700 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
msiexec.exeexplorer.exedescription pid process Token: SeRestorePrivilege 2608 msiexec.exe Token: SeTakeOwnershipPrivilege 2608 msiexec.exe Token: SeSecurityPrivilege 2608 msiexec.exe Token: SeShutdownPrivilege 700 explorer.exe Token: SeShutdownPrivilege 700 explorer.exe Token: SeShutdownPrivilege 700 explorer.exe Token: SeShutdownPrivilege 700 explorer.exe Token: SeShutdownPrivilege 700 explorer.exe Token: SeShutdownPrivilege 700 explorer.exe Token: SeShutdownPrivilege 700 explorer.exe Token: SeShutdownPrivilege 700 explorer.exe Token: SeShutdownPrivilege 700 explorer.exe Token: SeShutdownPrivilege 700 explorer.exe Token: SeShutdownPrivilege 700 explorer.exe Token: SeShutdownPrivilege 700 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
explorer.exepid process 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
explorer.exepid process 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe 700 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exedescription pid process target process PID 1368 wrote to memory of 2636 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 1368 wrote to memory of 2636 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 1368 wrote to memory of 2636 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 1368 wrote to memory of 2636 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 1368 wrote to memory of 1848 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 1368 wrote to memory of 1848 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 1368 wrote to memory of 1848 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 1368 wrote to memory of 1848 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe df6d4fb5b398bc1051f5a5914d7e41b6.exe PID 1368 wrote to memory of 1304 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe BE3.tmp PID 1368 wrote to memory of 1304 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe BE3.tmp PID 1368 wrote to memory of 1304 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe BE3.tmp PID 1368 wrote to memory of 1304 1368 df6d4fb5b398bc1051f5a5914d7e41b6.exe BE3.tmp -
System policy modification 1 TTPs 2 IoCs
Processes:
df6d4fb5b398bc1051f5a5914d7e41b6.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer df6d4fb5b398bc1051f5a5914d7e41b6.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" df6d4fb5b398bc1051f5a5914d7e41b6.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exe"C:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exeC:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exe startC:\Users\Admin\AppData\Roaming\8EAA6\0A62F.exe%C:\Users\Admin\AppData\Roaming\8EAA62⤵
-
C:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exeC:\Users\Admin\AppData\Local\Temp\df6d4fb5b398bc1051f5a5914d7e41b6.exe startC:\Program Files (x86)\A622A\lvvm.exe%C:\Program Files (x86)\A622A2⤵
-
C:\Program Files (x86)\LP\2FD8\BE3.tmp"C:\Program Files (x86)\LP\2FD8\BE3.tmp"2⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\8EAA6\622A.EAAFilesize
1KB
MD549fedc6117e0fb926dd5c4c6a1cffa02
SHA1b4dc7384f3d5b0ac5a4b5c50965c12cdc24b0524
SHA25611cc8616ca4c74df8dbeb401b032572cdd3f9a698dcab307886cbd33fc319d2b
SHA512c7ebae8029acc32d83d98d2a4a9b18eea06f42938b3dfb9dd7d31a3c8584b1107ff0bf5ea24d0a0a33a85c7a82787cc94e0e5f54b500d085eb9e8fa48190e284
-
C:\Users\Admin\AppData\Roaming\8EAA6\622A.EAAFilesize
600B
MD5d451b92d4d9e03b8567d5f9fa70562a8
SHA1dff74192d3f88001729f5c0872930c5eb125ad3b
SHA2563a5a9984d337870c887e357dd319d8355980c99253319d03e6319b78949f08b9
SHA512bb620c219c0a5f50846fbfbd2391d29c38a9435e1127cbd796239aef573aa700f29da06016a30a9b2690da680eec1273df8843999f8c52b0e795f8aaf8d9df73
-
C:\Users\Admin\AppData\Roaming\8EAA6\622A.EAAFilesize
1KB
MD51a4c082d7600374075fda39ee1ed7be1
SHA1415bbd163c9defdafe893c4450e5929e65de58a6
SHA2566eeabdba9ae9fab6ee8f46e0e5280d14589724b407206a99da317ebab8ce62dc
SHA51297dcfa35409e58bdd6ec4d8c31d9e3579e6d1fdaecd9810a7d58df5d5403a5dc4802254fd642b5461bdf56f3cbcaae5e28f4aee84f35e49d6eee09a449a3795f
-
C:\Users\Admin\AppData\Roaming\8EAA6\622A.EAAFilesize
996B
MD569b69cf414b3adb7f19876cea2111b4a
SHA172af30d00c1543b97b2f401b24725c9bde93f35d
SHA256894b1d4c5cbdea86bfefe1ae37abf5cb991021fda748ad180746c65f3ac7120b
SHA5127060094256a3a574ff5c03d8f1ee4b654cb015a583d1e4eb8a46a6a9b6b128a1a3b76f04ed0f0b2ce597aa5cb07c403b15a546aea7dc223542225693f3f06054
-
\Program Files (x86)\LP\2FD8\BE3.tmpFilesize
99KB
MD50d57642cffb4a4de227c0021ece3ec81
SHA1ce9d649dbcaf9e418064118bc26cd26c5fa50034
SHA25645fd7c3592c44074a862a22e362f2afbf4e718c0fcb13afbff95f4f7bdfe9c1d
SHA512340a0548cfdb6ab092b082d187262dcaf36c00c0b1ef2b03e3b3588105a139a2e2d55021f2151d2042b807da0a6bd7e4790fa3fa590e599d2a90fe9a8748a3fd
-
memory/700-111-0x00000000041A0000-0x00000000041A1000-memory.dmpFilesize
4KB
-
memory/700-204-0x00000000041A0000-0x00000000041A1000-memory.dmpFilesize
4KB
-
memory/1304-202-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1304-200-0x0000000000400000-0x000000000041C000-memory.dmpFilesize
112KB
-
memory/1304-201-0x0000000000570000-0x0000000000670000-memory.dmpFilesize
1024KB
-
memory/1368-15-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1368-107-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1368-75-0x0000000001ED0000-0x0000000001FD0000-memory.dmpFilesize
1024KB
-
memory/1368-1-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1368-199-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1368-7-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1368-2-0x0000000001ED0000-0x0000000001FD0000-memory.dmpFilesize
1024KB
-
memory/1368-207-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1848-108-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1848-109-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1848-110-0x0000000001E70000-0x0000000001F70000-memory.dmpFilesize
1024KB
-
memory/2636-13-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2636-14-0x0000000001F80000-0x0000000002080000-memory.dmpFilesize
1024KB