Analysis
-
max time kernel
1s -
max time network
1s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
19-05-2024 10:45
Static task
static1
Behavioral task
behavioral1
Sample
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe
Resource
win10v2004-20240508-en
General
-
Target
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe
-
Size
782KB
-
MD5
f0a5b6bb52a088b9b8ee76b341e58e2b
-
SHA1
d362d5dee873c8c62489b95f4beb9fb7c5887ba4
-
SHA256
5131d0642a54d02c54545e823e706b89be27243608a047c07349fbc30e07dde5
-
SHA512
d06932744b4a7c156deaf76fe6cf64aea3ee4f5a4e7465674f710d5791296d0f66fa922267e137d7bc135e2d42c7efe97cffdda9ae922f678b260ded8c256a60
-
SSDEEP
12288:o9y0Qed1VRfr655Kw6kRaDsaXz2QEPCJj7bo7C1OC40r24bvryRrQ4ZUCR:o9Ce3/s5b5sV06j7bYAl42n/yRMNC
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
svchost.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\permdata\\java.exe" svchost.exe -
Sets file to hidden 1 TTPs 1 IoCs
Modifies file attributes to stop it showing in Explorer etc.
-
Executes dropped EXE 2 IoCs
Processes:
svchost.exejava.exepid process 1944 svchost.exe 2484 java.exe -
Loads dropped DLL 2 IoCs
Processes:
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exesvchost.exepid process 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe 1944 svchost.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exesvchost.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Essentials = "C:\\Users\\Admin\\AppData\\Roaming\\MsMpEng.exe" VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe Set value (str) \REGISTRY\USER\S-1-5-21-2297530677-1229052932-2803917579-1000\Software\Microsoft\Windows\CurrentVersion\Run\java = "C:\\permdata\\java.exe" svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exedescription pid process target process PID 2796 set thread context of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious use of AdjustPrivilegeToken 24 IoCs
Processes:
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exesvchost.exedescription pid process Token: SeDebugPrivilege 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe Token: SeIncreaseQuotaPrivilege 1944 svchost.exe Token: SeSecurityPrivilege 1944 svchost.exe Token: SeTakeOwnershipPrivilege 1944 svchost.exe Token: SeLoadDriverPrivilege 1944 svchost.exe Token: SeSystemProfilePrivilege 1944 svchost.exe Token: SeSystemtimePrivilege 1944 svchost.exe Token: SeProfSingleProcessPrivilege 1944 svchost.exe Token: SeIncBasePriorityPrivilege 1944 svchost.exe Token: SeCreatePagefilePrivilege 1944 svchost.exe Token: SeBackupPrivilege 1944 svchost.exe Token: SeRestorePrivilege 1944 svchost.exe Token: SeShutdownPrivilege 1944 svchost.exe Token: SeDebugPrivilege 1944 svchost.exe Token: SeSystemEnvironmentPrivilege 1944 svchost.exe Token: SeChangeNotifyPrivilege 1944 svchost.exe Token: SeRemoteShutdownPrivilege 1944 svchost.exe Token: SeUndockPrivilege 1944 svchost.exe Token: SeManageVolumePrivilege 1944 svchost.exe Token: SeImpersonatePrivilege 1944 svchost.exe Token: SeCreateGlobalPrivilege 1944 svchost.exe Token: 33 1944 svchost.exe Token: 34 1944 svchost.exe Token: 35 1944 svchost.exe -
Suspicious use of WriteProcessMemory 25 IoCs
Processes:
VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exesvchost.execmd.exedescription pid process target process PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 2796 wrote to memory of 1944 2796 VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe svchost.exe PID 1944 wrote to memory of 2608 1944 svchost.exe cmd.exe PID 1944 wrote to memory of 2608 1944 svchost.exe cmd.exe PID 1944 wrote to memory of 2608 1944 svchost.exe cmd.exe PID 1944 wrote to memory of 2608 1944 svchost.exe cmd.exe PID 1944 wrote to memory of 2484 1944 svchost.exe java.exe PID 1944 wrote to memory of 2484 1944 svchost.exe java.exe PID 1944 wrote to memory of 2484 1944 svchost.exe java.exe PID 1944 wrote to memory of 2484 1944 svchost.exe java.exe PID 2608 wrote to memory of 2504 2608 cmd.exe attrib.exe PID 2608 wrote to memory of 2504 2608 cmd.exe attrib.exe PID 2608 wrote to memory of 2504 2608 cmd.exe attrib.exe PID 2608 wrote to memory of 2504 2608 cmd.exe attrib.exe -
Views/modifies file attributes 1 TTPs 1 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe"C:\Users\Admin\AppData\Local\Temp\VirusShare_f0a5b6bb52a088b9b8ee76b341e58e2b.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\svchost.exeC:\Users\Admin\AppData\Local\Temp\svchost.exe2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\tmpcmd.bat" "3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h4⤵
- Sets file to hidden
- Views/modifies file attributes
-
C:\permdata\java.exe"C:\permdata\java.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpcmd.batFilesize
50B
MD5b774ae3fb1da087e1f83b4f7b2060e5a
SHA197eb9be49ac3af9c851c9e1e84e32bfd53e325a8
SHA256adaf4a84b41e410b02e261cfd0fe7739d98647eab73c3badd32ac6e39f26351b
SHA512f75d0f95f7306d26a12b414bfe37b97fbd37546cb3c6e403def7077329ddffb4b45d5c5f0ba0e7bb6d72851d2d691b0a85267beead42f7cbf2e8c3d45a3b4701
-
\Users\Admin\AppData\Local\Temp\svchost.exeFilesize
31KB
MD5ed797d8dc2c92401985d162e42ffa450
SHA10f02fc517c7facc4baefde4fe9467fb6488ebabe
SHA256b746362010a101cb5931bc066f0f4d3fc740c02a68c1f37fc3c8e6c87fd7cb1e
SHA512e831a6ff987f3ef29982da16afad06938b68eddd43c234ba88d1c96a1b5547f2284baf35cbb3a5bfd75e7f0445d14daa014e0ba00b4db72c67f83f0a314c80c2
-
memory/1944-16-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-14-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-8-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-25-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-23-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-21-0x000000007EFDE000-0x000000007EFDF000-memory.dmpFilesize
4KB
-
memory/1944-20-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-18-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-52-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-32-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-13-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-12-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-10-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/1944-26-0x0000000000400000-0x00000000004CB000-memory.dmpFilesize
812KB
-
memory/2796-31-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/2796-3-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/2796-2-0x00000000744A0000-0x0000000074A4B000-memory.dmpFilesize
5.7MB
-
memory/2796-0-0x00000000744A1000-0x00000000744A2000-memory.dmpFilesize
4KB