Analysis
- max time kernel
148s - max time network
150s - platform
windows10-2004_x64 - resource
win10v2004-20240426-en - resource tags
arch:x64arch:x86image:win10v2004-20240426-enlocale:en-usos:windows10-2004-x64system - submitted
30/05/2024, 04:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe
Resource
win7-20240221-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe
Resource
win10v2004-20240426-en
windows10-2004-x64
9 signatures
150 seconds
General
- Target e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe
- Size 479KB
- Sample240530-ermzxsfa36
- SHA256 e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf
- MD5 3972a70115bf870c3b75e91a912ad09f
- SHA1 dad7624516222ae8d83aee3e4afba2736df2ad8e
- SHA512 9c351342dd992dfd03bdfa117b9a08ad685d2a378febacac3629dbd0bf700e97fb30c4ec5a6b1f2ca8b215b36fd040b707ba4e4034537fcc7367e4751f26d409
- SSDEEP 6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDnWe:nRDc3yWDNU+YUznzNjElWaT07NQtDWe
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\c:\users\admin\appdata\local\temp\e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe = "c:\\users\\admin\\appdata\\local\\temp\\e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe:*:Enabled:SMPN" e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe - Adds policy Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\Run e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\wdfmgr = "c:\\windows\\wdfmgr.exe" e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\msrpc = "c:\\windows\\msrpc.exe" e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wdfmgr\ImagePath = "c:\\windows\\wdfmgr.exe" e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe - Adds Run key to start application 2 TTPs 3 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\wdfmgr = "c:\\windows\\wdfmgr.exe" e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunServices\wdfmgr = "c:\\windows\\wdfmgr.exe" e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe Set value (str) \REGISTRY\USER\S-1-5-21-4018855536-2201274732-320770143-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lsassv = "c:\\windows\\lsassv.exe" e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe - Enumerates connected drives 3 TTPs 21 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\x: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\u: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\t: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\r: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\q: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\n: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\m: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\y: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\v: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\s: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\l: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\i: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\o: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\j: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\z: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\w: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\p: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\k: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\h: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened (read-only) \??\g: e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created \??\c:\windows\SysWOW64\regedit.exe e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe - Drops file in Windows directory 13 IoCs
description ioc Process File opened for modification \??\c:\windows\lsassv.exe e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File created \??\c:\windows\msrpc.exe e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened for modification \??\c:\windows\calc.exe e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File created \??\c:\windows\Ãëàâíîå ìåíþ\Ïðîãðàììû\Àâòîçàãðóçêà\AdobeLoader.scr e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File created \??\c:\windows\lsassv.exe e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened for modification \??\c:\windows\wdfmgr.exe e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File created \??\c:\windows\calc.exe e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened for modification \??\c:\windows\regedit2.exe e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File created \??\c:\windows\Start Menu\Programs\Startup\AdobeLoader.scr e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File created \??\c:\windows\wdfmgr.exe e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened for modification \??\c:\windows\msrpc.exe e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File created \??\c:\windows\regedit2.exe e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe File opened for modification \??\c:\windows\mui\rctfd.sys e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe - Modifies registry class 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\VerProg = "157" e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A} e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{65D5AFFB-D4EF-49AA-GFFG-5DA5E12E300A}\ThisEXE = "c:\\users\\admin\\appdata\\local\\temp\\e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe" e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe - Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 3268 e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe"C:\Users\Admin\AppData\Local\Temp\e1d94d53dd01b06c042d9f07dc20c68810ca027c3b1e5c7e1a35ff06c39420bf.exe"1⤵
- Modifies firewall policy service
- Adds policy Run key to start application
- Sets service image path in registry
- Adds Run key to start application
- Enumerates connected drives
- Drops file in System32 directory
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of FindShellTrayWindow
PID:3268
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Privilege Escalation
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Windows\msrpc.exe
- Size 479KB
- SHA256 aa0dedcda1db2fd0b59c981f59b82dba856aa2388839025dfa0c33cb0b205230
- MD5 cf9307822cdce149c67d47c2ac777672
- SHA1 387cff667d007a8a9b3977488c8ba69258a8b4b2
- SHA512 7a6c30c1a61b7ce1a999e1dadd7b2287d17437e7f2040f8cd52dcddf9120c596a14df842d49e7d45f2cf1e5a3b2b16f9a3e6ac3f567ca24d2198358d09c4a664
- SSDEEP 6144:pjFRiOcXH6XWD0w1tizmtnktLJ6znvxNcCI+1jDIlnJ9+1aTEPTnOK4JKElDnW4:nRDc3yWDNU+YUznzNjElWaT07NQtDW4
- MD5 SHA1 SHA512 SSDEEP