3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf

Analysis

max time kernel
149s
max time network
123s
platform
windows7_x64
resource
win7-20240221-en
resource tags

arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system
submitted
26-03-2024 19:23

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe
Size

244KB
MD5

d80829824a76c7928b5344265b308d55
SHA1

61af156c9f75ae243b1170718162f854fd63ddf2
SHA256

3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf
SHA512

867e8bfc65530e4b56550f45806411d541ed256083c3de85cffdef56dea85e9c4374da4d9d5d0ee95cb886b469f71c3ca6e50ac4c0c0ff1e977561d44528b790
SSDEEP

6144:FVAVnUHETL9r4vZiJce7l+imXBgGpcrMYX0bFAse:FVAVnUwyxmLmXPpEXK6s

Score

7^/10

persistence

Malware Config

Signatures

Executes dropped EXE 3 IoCs

pid	Process
1520	ciphdctr.exe
1684	~1FC0.tmp
2992	DpiSient.exe

Loads dropped DLL 3 IoCs

pid	Process
1632	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe
1632	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe
1520	ciphdctr.exe

Adds Run key to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1298544033-3225604241-2703760938-1000\Software\Microsoft\Windows\CurrentVersion\Run\DpiSient = "C:\\Users\\Admin\\AppData\\Roaming\\cttudiag\\ciphdctr.exe"	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe

Drops file in System32 directory 1 IoCs

description	ioc	Process
File created	C:\Windows\SysWOW64\DpiSient.exe	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe

Program crash 1 IoCs

pid	pid_target	Process	procid_target
2540	1632	WerFault.exe	27

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
1520	ciphdctr.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE
2992	DpiSient.exe
1204	Explorer.EXE

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1520	ciphdctr.exe
Token: SeShutdownPrivilege	1204	Explorer.EXE

Suspicious use of WriteProcessMemory 13 IoCs

description	pid	Process	procid_target
PID 1632 wrote to memory of 1520	1632	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe	28
PID 1632 wrote to memory of 1520	1632	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe	28
PID 1632 wrote to memory of 1520	1632	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe	28
PID 1632 wrote to memory of 1520	1632	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe	28
PID 1520 wrote to memory of 1684	1520	ciphdctr.exe	29
PID 1520 wrote to memory of 1684	1520	ciphdctr.exe	29
PID 1520 wrote to memory of 1684	1520	ciphdctr.exe	29
PID 1520 wrote to memory of 1684	1520	ciphdctr.exe	29
PID 1684 wrote to memory of 1204	1684	~1FC0.tmp	21
PID 1632 wrote to memory of 2540	1632	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe	31
PID 1632 wrote to memory of 2540	1632	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe	31
PID 1632 wrote to memory of 2540	1632	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe	31
PID 1632 wrote to memory of 2540	1632	3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe	31

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1204
- C:\Users\Admin\AppData\Local\Temp\3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe
  "C:\Users\Admin\AppData\Local\Temp\3f71265764d2877957c9ac6be73c514b67d04b5fa67e79d9b766696a3a65cecf.exe"
  2⤵
  - Loads dropped DLL
  - Adds Run key to start application
  - Drops file in System32 directory
  - Suspicious use of WriteProcessMemory
  PID:1632
- - C:\Users\Admin\AppData\Roaming\cttudiag\ciphdctr.exe
    "C:\Users\Admin\AppData\Roaming\cttudiag"
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1520
  - - C:\Users\Admin\AppData\Local\Temp\~1FC0.tmp
      1204 249864 1520 1
      4⤵
      Executes dropped EXE
      Suspicious use of WriteProcessMemory
      PID:1684
- - C:\Windows\SysWOW64\WerFault.exe
    C:\Windows\SysWOW64\WerFault.exe -u -p 1632 -s 252
    3⤵
    - Program crash
    PID:2540

C:\Windows\SysWOW64\DpiSient.exe
C:\Windows\SysWOW64\DpiSient.exe -s
1⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
PID:2992

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

C:\Users\Admin\AppData\Local\Temp\~1FC0.tmp

Filesize
8KB

MD5
aac3165ece2959f39ff98334618d10d9

SHA1
020a191bfdc70c1fbd3bf74cd7479258bd197f51

SHA256
96fa6a7714670823c83099ea01d24d6d3ae8fef027f01a4ddac14f123b1c9974

SHA512
9eb876812a6a13dd4b090788c2b1d9e9a2e25370598ed5c040f82e6f378edc4b78d58bc8f60d5a559ea57b1edcf3a144bfe09454a9928997173db8279d5b40cf

Download Submit
\Users\Admin\AppData\Roaming\cttudiag\ciphdctr.exe

Filesize
244KB

MD5
27183655ec5d1925cf12e284c5640425

SHA1
9696e0416e030becfbe22e3be907066ffadfe833

SHA256
2bb96db68cf15978a4924a64cd1529f807657a81fe19affe6635cf06789a6e6f

SHA512
1b7ed04417f1f44262b441a9a1d02e51eee64e8972cec11f27ed9894127d85505962d4f94c30c4662c7c598ec4901ff1e007d07e8ad7a9ecd50faac28953a0c1

Download Submit
memory/1204-22-0x0000000002B60000-0x0000000002B66000-memory.dmp

Filesize
24KB

Download
memory/1204-18-0x0000000002DF0000-0x0000000002E3D000-memory.dmp

Filesize
308KB

Download
memory/1204-17-0x0000000002DF0000-0x0000000002E3D000-memory.dmp

Filesize
308KB

Download
memory/1204-19-0x0000000002DF0000-0x0000000002E3D000-memory.dmp

Filesize
308KB

Download
memory/1204-25-0x0000000002E80000-0x0000000002E8D000-memory.dmp

Filesize
52KB

Download
memory/1520-12-0x00000000006A0000-0x00000000006E7000-memory.dmp

Filesize
284KB

Download
memory/1520-16-0x0000000000340000-0x0000000000346000-memory.dmp

Filesize
24KB

Download
memory/1632-0-0x0000000000320000-0x0000000000367000-memory.dmp

Filesize
284KB

Download
memory/1632-33-0x0000000000320000-0x0000000000367000-memory.dmp

Filesize
284KB

Download
memory/2992-26-0x0000000000320000-0x0000000000367000-memory.dmp

Filesize
284KB

Download
memory/2992-31-0x00000000003D0000-0x00000000003D6000-memory.dmp

Filesize
24KB

Download
memory/2992-32-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2992-28-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download
memory/2992-34-0x0000000000380000-0x0000000000386000-memory.dmp

Filesize
24KB

Download