Analysis
-
max time kernel
150s -
max time network
121s -
platform
windows7_x64 -
resource
win7-20240221-en -
resource tags
arch:x64arch:x86image:win7-20240221-enlocale:en-usos:windows7-x64system -
submitted
23-05-2024 03:45
Static task
static1
Behavioral task
behavioral1
Sample
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe
Resource
win10v2004-20240508-en
General
-
Target
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe
-
Size
44KB
-
MD5
3466738a59b6a76f5dd7059760478764
-
SHA1
1a722af337ea07904be6bf25ac96dbce0ed20f47
-
SHA256
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3
-
SHA512
08465ad91792436e624fa970095c00e474562424458205a8a3a70279c559024f66b077b29f2b884ed9c7f50c3aca42a985fbf85febc864f15de6b9dd2f12bbfa
-
SSDEEP
768:WAUJmQCcmLCXQq6fsKiJYsIkjJVzqsVG5kuGVAQvr9Vu18ys:RUNHFKQbIkHvGkA65p
Malware Config
Signatures
-
Processes:
rmass.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe -
Drops file in Drivers directory 1 IoCs
Processes:
rmass.exedescription ioc process File opened for modification C:\Windows\system32\drivers\etc\hosts rmass.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
Processes:
rmass.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46} rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\01234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123 = "a" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\IsInstalled = "1" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4B584950-5043-4b46-4B58-495050434b46}\StubPath = "C:\\Windows\\system32\\ahuy.exe" rmass.exe -
Sets file execution options in registry 2 TTPs 3 IoCs
Processes:
rmass.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\Debugger = "C:\\Windows\\system32\\ntdbg.exe" rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\explorer.exe\0123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890 = "a" rmass.exe -
Executes dropped EXE 2 IoCs
Processes:
rmass.exermass.exepid process 2632 rmass.exe 2108 rmass.exe -
Loads dropped DLL 3 IoCs
Processes:
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exermass.exepid process 2200 da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe 2200 da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe 2632 rmass.exe -
Processes:
rmass.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "5120" rmass.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "5120" rmass.exe -
Modifies WinLogon 2 TTPs 5 IoCs
Processes:
rmass.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\DLLName = "C:\\Windows\\system32\\RECOVER32.DLL" rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\Startup = "Startup" rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B} rmass.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify rmass.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\{BC84DF00-BC38-9902-8082-6FCBF2D87A0B}\012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345678901234567890123456789012345 = "a" rmass.exe -
Drops file in System32 directory 12 IoCs
Processes:
rmass.exeda5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exedescription ioc process File opened for modification C:\Windows\SysWOW64\rmass.exe rmass.exe File opened for modification C:\Windows\SysWOW64\ahuy.exe rmass.exe File opened for modification C:\Windows\SysWOW64\winrnt.exe rmass.exe File opened for modification C:\Windows\SysWOW64\aset32.exe rmass.exe File opened for modification C:\Windows\SysWOW64\idbg32.exe rmass.exe File created C:\Windows\SysWOW64\ahuy.exe rmass.exe File opened for modification C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File created C:\Windows\SysWOW64\RECOVER32.DLL rmass.exe File opened for modification C:\Windows\SysWOW64\rmass.exe da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe File created C:\Windows\SysWOW64\rmass.exe da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe File opened for modification C:\Windows\SysWOW64\ntdbg.exe rmass.exe File created C:\Windows\SysWOW64\ntdbg.exe rmass.exe -
Drops file in Program Files directory 3 IoCs
Processes:
rmass.exedescription ioc process File opened for modification C:\Program Files (x86)\Common Files\System\winrnt.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\aset32.exe rmass.exe File opened for modification C:\Program Files (x86)\Common Files\System\idbg32.exe rmass.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
rmass.exermass.exepid process 2632 rmass.exe 2632 rmass.exe 2632 rmass.exe 2108 rmass.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exermass.exedescription pid process Token: SeDebugPrivilege 2200 da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe Token: SeDebugPrivilege 2632 rmass.exe -
Suspicious use of WriteProcessMemory 10 IoCs
Processes:
da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exermass.exedescription pid process target process PID 2200 wrote to memory of 2632 2200 da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe rmass.exe PID 2200 wrote to memory of 2632 2200 da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe rmass.exe PID 2200 wrote to memory of 2632 2200 da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe rmass.exe PID 2200 wrote to memory of 2632 2200 da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe rmass.exe PID 2632 wrote to memory of 424 2632 rmass.exe winlogon.exe PID 2632 wrote to memory of 2108 2632 rmass.exe rmass.exe PID 2632 wrote to memory of 2108 2632 rmass.exe rmass.exe PID 2632 wrote to memory of 2108 2632 rmass.exe rmass.exe PID 2632 wrote to memory of 2108 2632 rmass.exe rmass.exe PID 2632 wrote to memory of 1260 2632 rmass.exe Explorer.EXE
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
-
C:\Users\Admin\AppData\Local\Temp\da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe"C:\Users\Admin\AppData\Local\Temp\da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3.exe"2⤵
- Loads dropped DLL
- Drops file in System32 directory
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rmass.exe"C:\Windows\system32\rmass.exe"3⤵
- Windows security bypass
- Drops file in Drivers directory
- Modifies Installed Components in the registry
- Sets file execution options in registry
- Executes dropped EXE
- Loads dropped DLL
- Windows security modification
- Modifies WinLogon
- Drops file in System32 directory
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\rmass.exe--k33p4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\SysWOW64\RECOVER32.DLLFilesize
5KB
MD52b2c28a7a01f9584fe220ef84003427f
SHA15fc023df0b5064045eb8de7f2dbe26f07f6fec70
SHA2569e00af53b1d0c0f5270d94a666d95aa7b4dcb9fea49487c210c055c9dcfcc9eb
SHA51239192a8a91dec1abff25af8dac0cf39da4dfd51b3fb4f1ef0b4e776185d4280fbe8387c2ea778da7bbf2ce288b0bce4d23cbe8d9e87bbd250159044f5adbac78
-
C:\Windows\SysWOW64\ahuy.exeFilesize
46KB
MD53c7bd809b77064f33480b43bb11cdfe2
SHA18e53a4e267cf921c5863a9301340bca1d65fad96
SHA256bb90c488b56088841db1b1edff262386cfbaeffa9061be2a24198dda147a6cb6
SHA512a89e6e6c65120036fdb405be4ed6dc0c179fc358d63c2840752490a1ad90a270ad2280794a43ba884e53fe211df462f670a2bfe0dd0757d7584d763d223bea1d
-
C:\Windows\SysWOW64\ntdbg.exeFilesize
47KB
MD51d107e180340156d30a1e11d941a8742
SHA1fb533f4cf5e055f5975c4e6275f89b7446e00aab
SHA256a74db0d8f022141ae74e794c5bb8ee799d807db4ecbbaf3bb37008df363739cc
SHA5120032847f383f993d9f1a8c4e1006a451bd58fa224a27a6bc7db598380079359a9aa5a59bc7f30c85d8ef8ea85901f93ada3865beb23d7f2cb1d43342ebba28d0
-
C:\Windows\System32\drivers\etc\hostsFilesize
1KB
MD5b10b13206b0f2cf3968050072f6979bf
SHA1699db21ba9cecf3f13ac3d76e22cfa41aa94da80
SHA2560eef3217095cb97b695c434e74d6314bf9e869a013d6e9c88e58c34576a276b4
SHA512d33bfd931be6676539507a69101d99fa4c5ef36b12422bd11f063b9b6a47b7444f6c4ad5f35e044714fdb872e96cd9fddf049e8329af1219483887f6ac5f4a5d
-
\Windows\SysWOW64\rmass.exeFilesize
44KB
MD53466738a59b6a76f5dd7059760478764
SHA11a722af337ea07904be6bf25ac96dbce0ed20f47
SHA256da5c7f582d1cfdfb11807f82ca401c8b2207e9079ea46bd1b6e163d011843fd3
SHA51208465ad91792436e624fa970095c00e474562424458205a8a3a70279c559024f66b077b29f2b884ed9c7f50c3aca42a985fbf85febc864f15de6b9dd2f12bbfa
-
memory/2108-53-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2200-9-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB
-
memory/2632-52-0x0000000000400000-0x000000000040E000-memory.dmpFilesize
56KB