Analysis
-
max time kernel
148s -
max time network
149s -
platform
windows10-2004_x64 -
resource
win10v2004-20240704-en -
resource tags
arch:x64arch:x86image:win10v2004-20240704-enlocale:en-usos:windows10-2004-x64system -
submitted
06-07-2024 19:54
Behavioral task
behavioral1
Sample
29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe
Resource
win7-20240705-en
windows7-x64
7 signatures
150 seconds
General
-
Target
29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe
-
Size
202KB
-
MD5
13053a6ac5c0422b5d17040f60a8da75
-
SHA1
afa55ecbd6b8ccef76b9f3c10890f80645035bf1
-
SHA256
29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119
-
SHA512
69dbe917e3e135d8210338745824bea61885e114ea859e3489362763ec7597a29089b789b4fb44534475a3e356e36fb2a46ecdf9fb38d99a7a68d9f7c9ad9df0
-
SSDEEP
3072:wzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIABSAShCWi5bu/qaBAIfG8vabG:wLV6Bta6dtJmakIM5mFhCWKbuf+PL4T
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\SMTP Monitor = "C:\\Program Files (x86)\\SMTP Monitor\\smtpmon.exe" 29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe -
Processes:
29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe -
Drops file in Program Files directory 2 IoCs
Processes:
29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exedescription ioc process File created C:\Program Files (x86)\SMTP Monitor\smtpmon.exe 29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe File opened for modification C:\Program Files (x86)\SMTP Monitor\smtpmon.exe 29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exepid process 4612 29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe 4612 29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe 4612 29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exepid process 4612 29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exedescription pid process Token: SeDebugPrivilege 4612 29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe"C:\Users\Admin\AppData\Local\Temp\29ee6d0a9c215c64f7406d29bb760bb271f726efdf9bcdbfcf22841721871119.exe"1⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4612-0-0x0000000075452000-0x0000000075453000-memory.dmpFilesize
4KB
-
memory/4612-1-0x0000000075450000-0x0000000075A01000-memory.dmpFilesize
5.7MB
-
memory/4612-2-0x0000000075450000-0x0000000075A01000-memory.dmpFilesize
5.7MB
-
memory/4612-5-0x0000000075450000-0x0000000075A01000-memory.dmpFilesize
5.7MB
-
memory/4612-6-0x0000000075450000-0x0000000075A01000-memory.dmpFilesize
5.7MB
-
memory/4612-7-0x0000000075452000-0x0000000075453000-memory.dmpFilesize
4KB
-
memory/4612-8-0x0000000075450000-0x0000000075A01000-memory.dmpFilesize
5.7MB
-
memory/4612-9-0x0000000075450000-0x0000000075A01000-memory.dmpFilesize
5.7MB