Analysis
-
max time kernel
122s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
15/05/2024, 20:44
Behavioral task
behavioral1
Sample
32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe
Resource
win7-20240221-en
windows7-x64
16 signatures
150 seconds
Behavioral task
behavioral2
Sample
32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe
-
Size
232KB
-
MD5
6202ec619dc70984cba34816fe9898fd
-
SHA1
c446d1cf461079032c032bafc86cb4991568f27b
-
SHA256
32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e
-
SHA512
3db39c690ba3e91acc8272725c1c2d104525f518ee14665597b6eb28d65d1203f326b6e87c00ba91ceec71f21ed8379d37937718e594d10d7e22ed6a19d35696
-
SSDEEP
6144:2hF4ca+NWJH7igNgjdFKsvoSmMKqsoSCf:2M9OXzoSm9qsoSCf
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe \"C:\\Windows\\system32\\IExplorer.exe\"" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\IExplorer.exe" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe -
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe -
UPX dump on OEP (original entry point) 2 IoCs
resource yara_rule behavioral1/memory/1948-0-0x0000000000400000-0x0000000000430000-memory.dmp UPX behavioral1/memory/1948-3-0x0000000000400000-0x0000000000430000-memory.dmp UPX -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe -
Disables use of System Restore points 1 TTPs
-
Modifies system executable filetype association 2 TTPs 13 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe -
resource yara_rule behavioral1/memory/1948-0-0x0000000000400000-0x0000000000430000-memory.dmp upx behavioral1/memory/1948-3-0x0000000000400000-0x0000000000430000-memory.dmp upx -
Adds Run key to start application 2 TTPs 5 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\MSMSGS = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\WINLOGON.EXE" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\ServiceAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\SERVICES.EXE" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\LogonAdmin = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\CSRSS.EXE" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\System Monitoring = "C:\\Users\\Admin\\Local Settings\\Application Data\\WINDOWS\\LSASS.EXE" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Software\Microsoft\Windows\CurrentVersion\Run\xk = "C:\\Windows\\xk.exe" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 1880 1948 WerFault.exe 27 -
Modifies Control Panel 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\ 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\SCRNSAVE.EXE = "C:\\Windows\\system32\\Mig~mig.SCR" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\ScreenSaverIsSecure = "0" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\USER\S-1-5-21-3452737119-3959686427-228443150-1000\Control Panel\Desktop\ScreenSaveTimeOut = "600" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe -
Modifies registry class 15 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\batfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\comfile\shell\open\command 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\exefile 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\ = "File Folder" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\exefile\shell\open\command\ = "\"C:\\Windows\\system32\\shell.exe\" \"%1\" %*" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\lnkfile\shell 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\piffile\shell\open\command 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1948 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1948 wrote to memory of 1880 1948 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe 28 PID 1948 wrote to memory of 1880 1948 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe 28 PID 1948 wrote to memory of 1880 1948 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe 28 PID 1948 wrote to memory of 1880 1948 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe 28 -
System policy modification 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoFolderOptions = "1" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" 32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe"C:\Users\Admin\AppData\Local\Temp\32fcce83f4b3ad311f7fdfc95fada77ccab81710c87373e0d175b28d9719499e.exe"1⤵
- Modifies WinLogon for persistence
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Disables RegEdit via registry modification
- Modifies system executable filetype association
- Adds Run key to start application
- Modifies Control Panel
- Modifies registry class
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1948 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1948 -s 3722⤵
- Program crash
PID:1880
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Event Triggered Execution
1Change Default File Association
1