Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20240709-en -
resource tags
arch:x64arch:x86image:win10v2004-20240709-enlocale:en-usos:windows10-2004-x64system -
submitted
11-07-2024 21:55
Behavioral task
behavioral1
Sample
playit.exe
Resource
win7-20240708-en
General
-
Target
playit.exe
-
Size
202KB
-
MD5
96922ff790264130780d92489a232eb0
-
SHA1
c75d43dbb381650ec0a9684867b968bf658a0304
-
SHA256
a4aa9acf04e3377f7d0fd23f0677e29cf885436ee18af02de049899a9ab62d61
-
SHA512
0e50f48171d151aca6006f158be6d08985c62e915a5ec46fa9e9e1dc18c38112b4261209158826b15a0c48e05ac26a5af87628e6b57212c0590f962a7a06809d
-
SSDEEP
3072:QzEqV6B1jHa6dtJ10jgvzcgi+oG/j9iaMP2s/HIRpPl1W4F0MpeCWBxwEJcA:QLV6Bta6dtJmakIM56lY4yMpeCoxwEx
Malware Config
Signatures
-
Boot or Logon Autostart Execution: Active Setup 2 TTPs 1 IoCs
Adversaries may achieve persistence by adding a Registry key to the Active Setup of the local machine.
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
playit.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Control Panel\International\Geo\Nation playit.exe -
Processes:
playit.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA playit.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
explorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\Software\Microsoft\Internet Explorer\Toolbar explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\Locked = "1" explorer.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000\SOFTWARE\Microsoft\Internet Explorer\Toolbar\ShellBrowser\ITBar7Layout = 13000000000000000000000020000000100000000000000001000000010700005e01000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 explorer.exe -
Modifies registry class 10 IoCs
Processes:
explorer.exeexplorer.exeexplorer.exeexplorer.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance\ explorer.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance\ explorer.exe Key created \REGISTRY\MACHINE\Software\Classes\Local Settings\Software\Microsoft\Windows\CurrentVersion\AppModel\Deployment\Package\*\S-1-5-21-384068567-2943195810-3631207890-1000\{02AA19AA-5339-4821-9219-26C118172503} explorer.exe Key created \REGISTRY\USER\S-1-5-21-384068567-2943195810-3631207890-1000_Classes\Local Settings explorer.exe -
Suspicious behavior: AddClipboardFormatListener 2 IoCs
Processes:
explorer.exepid process 2180 explorer.exe 2180 explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
playit.exepid process 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe 2960 playit.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
playit.exepid process 2960 playit.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
playit.exeexplorer.exedescription pid process Token: SeDebugPrivilege 2960 playit.exe Token: SeShutdownPrivilege 4112 explorer.exe Token: SeCreatePagefilePrivilege 4112 explorer.exe Token: SeShutdownPrivilege 4112 explorer.exe Token: SeCreatePagefilePrivilege 4112 explorer.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
explorer.exepid process 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe 2180 explorer.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
playit.exedescription pid process target process PID 2960 wrote to memory of 4648 2960 playit.exe cmd.exe PID 2960 wrote to memory of 4648 2960 playit.exe cmd.exe PID 2960 wrote to memory of 4648 2960 playit.exe cmd.exe PID 2960 wrote to memory of 4800 2960 playit.exe explorer.exe PID 2960 wrote to memory of 4800 2960 playit.exe explorer.exe PID 2960 wrote to memory of 4800 2960 playit.exe explorer.exe PID 2960 wrote to memory of 2568 2960 playit.exe explorer.exe PID 2960 wrote to memory of 2568 2960 playit.exe explorer.exe PID 2960 wrote to memory of 2568 2960 playit.exe explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\playit.exe"C:\Users\Admin\AppData\Local\Temp\playit.exe"1⤵
- Checks computer location settings
- Checks whether UAC is enabled
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe"2⤵
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"2⤵
- Modifies registry class
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\System32\explorer.exe"2⤵
- Modifies registry class
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Boot or Logon Autostart Execution: Active Setup
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{682159d9-c321-47ca-b3f1-30e36b2ec8b9} -Embedding1⤵
- Modifies Internet Explorer settings
- Modifies registry class
- Suspicious behavior: AddClipboardFormatListener
- Suspicious use of SetWindowsHookEx
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe shell32.dll,SHCreateLocalServerRunDll {9BA05972-F6A8-11CF-A442-00A0C90A8F39} -Embedding1⤵
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {3eef301f-b596-4c0b-bd92-013beafce793} -Embedding1⤵
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\89CDA556-130E-4F17-88AB-AF18FE5B92E6\settings.bakFilesize
128B
MD518f349c5b2e32cdd1c3aa0e7ac253873
SHA18497ca1747ad4da3e96d04e697b7878a7ebba844
SHA256d2498e7aa30426a3bc2af4727dc6f47b7b503f357b8f3312c65e919ad73cc809
SHA512bb2d6d7932339ed23dc09a0e4dd007c7d5720c5d7e7fa0c636c8ccc2e58f2cf112b6c05a4b90707777f410cf3ca61750ed81d8c846a76d67188d4c1a07501154
-
memory/2960-0-0x00000000751E2000-0x00000000751E3000-memory.dmpFilesize
4KB
-
memory/2960-1-0x00000000751E0000-0x0000000075791000-memory.dmpFilesize
5.7MB
-
memory/2960-2-0x00000000751E0000-0x0000000075791000-memory.dmpFilesize
5.7MB
-
memory/2960-4-0x00000000751E0000-0x0000000075791000-memory.dmpFilesize
5.7MB
-
memory/2960-8-0x00000000751E2000-0x00000000751E3000-memory.dmpFilesize
4KB
-
memory/2960-9-0x00000000751E0000-0x0000000075791000-memory.dmpFilesize
5.7MB
-
memory/2960-10-0x00000000751E0000-0x0000000075791000-memory.dmpFilesize
5.7MB
-
memory/2960-11-0x00000000751E0000-0x0000000075791000-memory.dmpFilesize
5.7MB
-
memory/2960-12-0x00000000751E0000-0x0000000075791000-memory.dmpFilesize
5.7MB