Analysis
-
max time kernel
141s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
27-03-2024 07:23
Static task
static1
Behavioral task
behavioral1
Sample
e11b07de217fd3393260f882361ec1a7.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
e11b07de217fd3393260f882361ec1a7.exe
Resource
win10v2004-20240226-en
General
-
Target
e11b07de217fd3393260f882361ec1a7.exe
-
Size
288KB
-
MD5
e11b07de217fd3393260f882361ec1a7
-
SHA1
b1ecd38e2e1911986a8b5ac3aaa627925161ac8d
-
SHA256
7cd00e06d5562d0fe748c83413fc3374f7b6a4d10e1d32f9df8c7c6e4d7a71bc
-
SHA512
cf29a20f2a1c8d4495b30d02144260c2ae80db824973b2140eb3efd30ea31fa217525edcea41ba4a560ac1fefebfc98dc8f8bf9fb975b11abcf35a6ed407e3c3
-
SSDEEP
6144:xX8JXHMQUXu+9qjCTWeqKas8hiAHlkyvbhA5qLXtE8VZP6lnrlZdgpP:uBM7u+xWEAyeAGy8V168P
Malware Config
Signatures
-
Modifies security service 2 TTPs 1 IoCs
Processes:
e11b07de217fd3393260f882361ec1a7.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "3" e11b07de217fd3393260f882361ec1a7.exe -
Disables taskbar notifications via registry modification
-
Modifies Installed Components in the registry 2 TTPs 1 IoCs
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Executes dropped EXE 1 IoCs
Processes:
14C8.tmppid process 2344 14C8.tmp -
Loads dropped DLL 2 IoCs
Processes:
e11b07de217fd3393260f882361ec1a7.exepid process 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe -
Reads data files stored by FTP clients 2 TTPs
Tries to access configuration files associated with programs like FileZilla.
-
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Processes:
resource yara_rule behavioral1/memory/1704-1-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1704-11-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2144-14-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/2144-13-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1704-174-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1440-179-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1704-180-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1704-303-0x0000000000400000-0x000000000046B000-memory.dmp upx behavioral1/memory/1704-309-0x0000000000400000-0x000000000046B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
e11b07de217fd3393260f882361ec1a7.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\DDC.exe = "C:\\Program Files (x86)\\LP\\9DF9\\DDC.exe" e11b07de217fd3393260f882361ec1a7.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Program Files directory 3 IoCs
Processes:
e11b07de217fd3393260f882361ec1a7.exedescription ioc process File created C:\Program Files (x86)\LP\9DF9\DDC.exe e11b07de217fd3393260f882361ec1a7.exe File opened for modification C:\Program Files (x86)\LP\9DF9\DDC.exe e11b07de217fd3393260f882361ec1a7.exe File opened for modification C:\Program Files (x86)\LP\9DF9\14C8.tmp e11b07de217fd3393260f882361ec1a7.exe -
Modifies registry class 5 IoCs
Processes:
explorer.exedescription ioc process Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-330940541-141609230-1670313778-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
Processes:
e11b07de217fd3393260f882361ec1a7.exepid process 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe 1704 e11b07de217fd3393260f882361ec1a7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
explorer.exepid process 976 explorer.exe -
Suspicious use of AdjustPrivilegeToken 15 IoCs
Processes:
msiexec.exeexplorer.exedescription pid process Token: SeRestorePrivilege 2864 msiexec.exe Token: SeTakeOwnershipPrivilege 2864 msiexec.exe Token: SeSecurityPrivilege 2864 msiexec.exe Token: SeShutdownPrivilege 976 explorer.exe Token: SeShutdownPrivilege 976 explorer.exe Token: SeShutdownPrivilege 976 explorer.exe Token: SeShutdownPrivilege 976 explorer.exe Token: SeShutdownPrivilege 976 explorer.exe Token: SeShutdownPrivilege 976 explorer.exe Token: SeShutdownPrivilege 976 explorer.exe Token: SeShutdownPrivilege 976 explorer.exe Token: SeShutdownPrivilege 976 explorer.exe Token: SeShutdownPrivilege 976 explorer.exe Token: SeShutdownPrivilege 976 explorer.exe Token: SeShutdownPrivilege 976 explorer.exe -
Suspicious use of FindShellTrayWindow 28 IoCs
Processes:
explorer.exepid process 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe -
Suspicious use of SendNotifyMessage 18 IoCs
Processes:
explorer.exepid process 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe 976 explorer.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
e11b07de217fd3393260f882361ec1a7.exedescription pid process target process PID 1704 wrote to memory of 2144 1704 e11b07de217fd3393260f882361ec1a7.exe e11b07de217fd3393260f882361ec1a7.exe PID 1704 wrote to memory of 2144 1704 e11b07de217fd3393260f882361ec1a7.exe e11b07de217fd3393260f882361ec1a7.exe PID 1704 wrote to memory of 2144 1704 e11b07de217fd3393260f882361ec1a7.exe e11b07de217fd3393260f882361ec1a7.exe PID 1704 wrote to memory of 2144 1704 e11b07de217fd3393260f882361ec1a7.exe e11b07de217fd3393260f882361ec1a7.exe PID 1704 wrote to memory of 1440 1704 e11b07de217fd3393260f882361ec1a7.exe e11b07de217fd3393260f882361ec1a7.exe PID 1704 wrote to memory of 1440 1704 e11b07de217fd3393260f882361ec1a7.exe e11b07de217fd3393260f882361ec1a7.exe PID 1704 wrote to memory of 1440 1704 e11b07de217fd3393260f882361ec1a7.exe e11b07de217fd3393260f882361ec1a7.exe PID 1704 wrote to memory of 1440 1704 e11b07de217fd3393260f882361ec1a7.exe e11b07de217fd3393260f882361ec1a7.exe PID 1704 wrote to memory of 2344 1704 e11b07de217fd3393260f882361ec1a7.exe 14C8.tmp PID 1704 wrote to memory of 2344 1704 e11b07de217fd3393260f882361ec1a7.exe 14C8.tmp PID 1704 wrote to memory of 2344 1704 e11b07de217fd3393260f882361ec1a7.exe 14C8.tmp PID 1704 wrote to memory of 2344 1704 e11b07de217fd3393260f882361ec1a7.exe 14C8.tmp -
System policy modification 1 TTPs 2 IoCs
Processes:
e11b07de217fd3393260f882361ec1a7.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer e11b07de217fd3393260f882361ec1a7.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\HideSCAHealth = "1" e11b07de217fd3393260f882361ec1a7.exe -
Uses Task Scheduler COM API 1 TTPs
The Task Scheduler COM API can be used to schedule applications to run on boot or at set times.
Processes
-
C:\Users\Admin\AppData\Local\Temp\e11b07de217fd3393260f882361ec1a7.exe"C:\Users\Admin\AppData\Local\Temp\e11b07de217fd3393260f882361ec1a7.exe"1⤵
- Modifies security service
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- System policy modification
-
C:\Users\Admin\AppData\Local\Temp\e11b07de217fd3393260f882361ec1a7.exeC:\Users\Admin\AppData\Local\Temp\e11b07de217fd3393260f882361ec1a7.exe startC:\Users\Admin\AppData\Roaming\99CF6\6219D.exe%C:\Users\Admin\AppData\Roaming\99CF62⤵
-
C:\Users\Admin\AppData\Local\Temp\e11b07de217fd3393260f882361ec1a7.exeC:\Users\Admin\AppData\Local\Temp\e11b07de217fd3393260f882361ec1a7.exe startC:\Program Files (x86)\F678E\lvvm.exe%C:\Program Files (x86)\F678E2⤵
-
C:\Program Files (x86)\LP\9DF9\14C8.tmp"C:\Program Files (x86)\LP\9DF9\14C8.tmp"2⤵
- Executes dropped EXE
-
C:\Windows\system32\msiexec.exeC:\Windows\system32\msiexec.exe /V1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
2Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\99CF6\678E.9CFFilesize
996B
MD5758acdfc6049625615881f4bd47fb57e
SHA15a7d8a4d9cb1ec1a3fc91447bf1fff49edfb6d98
SHA256835275314f219b00336bdf8981a44a56e2a48402117438a02e8be8052f60adc0
SHA512c088a3bd3f512bedf5dec82b1c637489966eb6e2a6f9a3b0455aefebdd7fb2efc65f6f095cb6d3a13eaa26e7b95b6a93a044252f3403371a88367ea61b79e91f
-
C:\Users\Admin\AppData\Roaming\99CF6\678E.9CFFilesize
600B
MD56ef9ee8c092acb15786a35f4b4b1c8fc
SHA15b7a448a231c18074dfe54b191a3b3846156e446
SHA2564b841d347104738974e834b39cb9473ed24c4a252c715b34552013a5dd9e3b33
SHA512c7dcfef2a0db4048a92b44d8dd94189cb6a8c0babbd98530d5493877c326e2e4d5c926e8ec97f8ae2d5a379fbcee0bbb1da77830bee130b8d3eeee9162651577
-
C:\Users\Admin\AppData\Roaming\99CF6\678E.9CFFilesize
1KB
MD5b33275b60e0ca22f06fe89e6be9a15be
SHA17f3f13554fbee9a616c3a3f8db8819e6f9762d6c
SHA25691afd023a89d9eed879c31f3a9d2a793abed5e493e13f404179277e18be275c1
SHA5122702f96f88d3e0db922f522d50a88f5cb483116510ea99eb3e48754dfc6eacd2a73562ff5686d80240fc49b29eec727d06692bdc7810200398c5f69a2dda2a76
-
\Program Files (x86)\LP\9DF9\14C8.tmpFilesize
102KB
MD53dd4e5cd0cb32f735268a740c647065a
SHA15e88431137152bf76f61d06b1c2086ecd5082a76
SHA256a1cb303db454c3faa73fa6705c9a7ce126110615879047fbd579d2c813fba535
SHA51237463297b6e127dc2689f2b998b14042189baa26727ab1770fc482035b09df2cd3f349fb11038fabde84d0b4a5a07bfc6b5c619001ddc70c9c37c0aa87b3fe04
-
memory/976-306-0x0000000003D50000-0x0000000003D51000-memory.dmpFilesize
4KB
-
memory/976-181-0x0000000003D50000-0x0000000003D51000-memory.dmpFilesize
4KB
-
memory/1440-179-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1440-178-0x0000000000610000-0x0000000000710000-memory.dmpFilesize
1024KB
-
memory/1440-177-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1704-303-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1704-11-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1704-174-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1704-175-0x00000000005B0000-0x00000000006B0000-memory.dmpFilesize
1024KB
-
memory/1704-180-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1704-309-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/1704-2-0x00000000005B0000-0x00000000006B0000-memory.dmpFilesize
1024KB
-
memory/1704-1-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2144-13-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2144-14-0x0000000000400000-0x000000000046B000-memory.dmpFilesize
428KB
-
memory/2144-15-0x00000000005B0000-0x00000000006B0000-memory.dmpFilesize
1024KB
-
memory/2344-301-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB
-
memory/2344-302-0x00000000004C0000-0x00000000005C0000-memory.dmpFilesize
1024KB
-
memory/2344-304-0x0000000000400000-0x000000000041D000-memory.dmpFilesize
116KB