Analysis
-
max time kernel
271s -
max time network
124s -
platform
windows7_x64 -
resource
win7-20240705-en -
resource tags
arch:x64arch:x86image:win7-20240705-enlocale:en-usos:windows7-x64system -
submitted
18-07-2024 22:41
Static task
static1
Behavioral task
behavioral1
Sample
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe
Resource
win7-20240705-en
Behavioral task
behavioral2
Sample
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe
Resource
win10-20240611-en
General
-
Target
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe
-
Size
2.2MB
-
MD5
ffe6422dff4cbe7efdbd7ac4983504d4
-
SHA1
b67e47c4469476baa69803a3183f2c5a821ad5b1
-
SHA256
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26
-
SHA512
626e085ef91b16ba1d2c7211de287854b4a7e85282ccc5a863aa3603f5249ad6dcd2ae2127142268341a5cc28d91ba4f6b9bab3bef268f35e3e683ee929bf499
-
SSDEEP
49152:z79Bu1YpCIlTKgirv6NruEf9MpehiCcOIo8R+jl3W:zpBu2flTXmpehGOV8cjRW
Malware Config
Signatures
-
Executes dropped EXE 7 IoCs
Processes:
ntclvjw.exentclvjw.exentclvjw.exentclvjw.exentclvjw.exentclvjw.exentclvjw.exepid process 868 ntclvjw.exe 3296 ntclvjw.exe 3480 ntclvjw.exe 2352 ntclvjw.exe 2004 ntclvjw.exe 2928 ntclvjw.exe 1208 ntclvjw.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3502430532-24693940-2469786940-1000\Software\Microsoft\Windows\CurrentVersion\Run\Hypdhoszwhs = "C:\\Users\\Admin\\AppData\\Roaming\\Hypdhoszwhs.exe" db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe -
Suspicious use of SetThreadContext 4 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exentclvjw.exentclvjw.exentclvjw.exedescription pid process target process PID 1856 set thread context of 1644 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 868 set thread context of 3296 868 ntclvjw.exe ntclvjw.exe PID 3480 set thread context of 2352 3480 ntclvjw.exe ntclvjw.exe PID 2004 set thread context of 2928 2004 ntclvjw.exe ntclvjw.exe -
Drops file in Windows directory 1 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exedescription ioc process File created C:\Windows\Tasks\Test Task17.job db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe -
Suspicious use of AdjustPrivilegeToken 9 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exentclvjw.exentclvjw.exentclvjw.exentclvjw.exedescription pid process Token: SeDebugPrivilege 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe Token: SeDebugPrivilege 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe Token: SeDebugPrivilege 868 ntclvjw.exe Token: SeDebugPrivilege 868 ntclvjw.exe Token: SeDebugPrivilege 3480 ntclvjw.exe Token: SeDebugPrivilege 3480 ntclvjw.exe Token: SeDebugPrivilege 2004 ntclvjw.exe Token: SeDebugPrivilege 2004 ntclvjw.exe Token: SeDebugPrivilege 1208 ntclvjw.exe -
Suspicious use of WriteProcessMemory 52 IoCs
Processes:
db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exetaskeng.exentclvjw.exentclvjw.exentclvjw.exedescription pid process target process PID 1856 wrote to memory of 1644 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 1856 wrote to memory of 1644 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 1856 wrote to memory of 1644 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 1856 wrote to memory of 1644 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 1856 wrote to memory of 1644 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 1856 wrote to memory of 1644 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 1856 wrote to memory of 1644 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 1856 wrote to memory of 1644 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 1856 wrote to memory of 1644 1856 db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe PID 468 wrote to memory of 868 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 868 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 868 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 868 468 taskeng.exe ntclvjw.exe PID 868 wrote to memory of 3296 868 ntclvjw.exe ntclvjw.exe PID 868 wrote to memory of 3296 868 ntclvjw.exe ntclvjw.exe PID 868 wrote to memory of 3296 868 ntclvjw.exe ntclvjw.exe PID 868 wrote to memory of 3296 868 ntclvjw.exe ntclvjw.exe PID 868 wrote to memory of 3296 868 ntclvjw.exe ntclvjw.exe PID 868 wrote to memory of 3296 868 ntclvjw.exe ntclvjw.exe PID 868 wrote to memory of 3296 868 ntclvjw.exe ntclvjw.exe PID 868 wrote to memory of 3296 868 ntclvjw.exe ntclvjw.exe PID 868 wrote to memory of 3296 868 ntclvjw.exe ntclvjw.exe PID 468 wrote to memory of 3480 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 3480 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 3480 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 3480 468 taskeng.exe ntclvjw.exe PID 3480 wrote to memory of 2352 3480 ntclvjw.exe ntclvjw.exe PID 3480 wrote to memory of 2352 3480 ntclvjw.exe ntclvjw.exe PID 3480 wrote to memory of 2352 3480 ntclvjw.exe ntclvjw.exe PID 3480 wrote to memory of 2352 3480 ntclvjw.exe ntclvjw.exe PID 3480 wrote to memory of 2352 3480 ntclvjw.exe ntclvjw.exe PID 3480 wrote to memory of 2352 3480 ntclvjw.exe ntclvjw.exe PID 3480 wrote to memory of 2352 3480 ntclvjw.exe ntclvjw.exe PID 3480 wrote to memory of 2352 3480 ntclvjw.exe ntclvjw.exe PID 3480 wrote to memory of 2352 3480 ntclvjw.exe ntclvjw.exe PID 468 wrote to memory of 2004 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 2004 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 2004 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 2004 468 taskeng.exe ntclvjw.exe PID 2004 wrote to memory of 2928 2004 ntclvjw.exe ntclvjw.exe PID 2004 wrote to memory of 2928 2004 ntclvjw.exe ntclvjw.exe PID 2004 wrote to memory of 2928 2004 ntclvjw.exe ntclvjw.exe PID 2004 wrote to memory of 2928 2004 ntclvjw.exe ntclvjw.exe PID 2004 wrote to memory of 2928 2004 ntclvjw.exe ntclvjw.exe PID 2004 wrote to memory of 2928 2004 ntclvjw.exe ntclvjw.exe PID 2004 wrote to memory of 2928 2004 ntclvjw.exe ntclvjw.exe PID 2004 wrote to memory of 2928 2004 ntclvjw.exe ntclvjw.exe PID 2004 wrote to memory of 2928 2004 ntclvjw.exe ntclvjw.exe PID 468 wrote to memory of 1208 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 1208 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 1208 468 taskeng.exe ntclvjw.exe PID 468 wrote to memory of 1208 468 taskeng.exe ntclvjw.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"C:\Users\Admin\AppData\Local\Temp\db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26.exe"2⤵
- Drops file in Windows directory
PID:1644
-
C:\Windows\system32\taskeng.exetaskeng.exe {973878DC-F5D3-47B5-A0E0-E6FE8AECD18C} S-1-5-21-3502430532-24693940-2469786940-1000:PSBQWFYT\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\ProgramData\aejki\ntclvjw.exeC:\ProgramData\aejki\ntclvjw.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:868 -
C:\ProgramData\aejki\ntclvjw.exe"C:\ProgramData\aejki\ntclvjw.exe"3⤵
- Executes dropped EXE
PID:3296 -
C:\ProgramData\aejki\ntclvjw.exeC:\ProgramData\aejki\ntclvjw.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\ProgramData\aejki\ntclvjw.exe"C:\ProgramData\aejki\ntclvjw.exe"3⤵
- Executes dropped EXE
PID:2352 -
C:\ProgramData\aejki\ntclvjw.exeC:\ProgramData\aejki\ntclvjw.exe2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2004 -
C:\ProgramData\aejki\ntclvjw.exe"C:\ProgramData\aejki\ntclvjw.exe"3⤵
- Executes dropped EXE
PID:2928 -
C:\ProgramData\aejki\ntclvjw.exeC:\ProgramData\aejki\ntclvjw.exe2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1208
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2.2MB
MD5ffe6422dff4cbe7efdbd7ac4983504d4
SHA1b67e47c4469476baa69803a3183f2c5a821ad5b1
SHA256db4d63069f8ba1604f971997cff723b7ed36153cd6b29d04ea0fc341236d9b26
SHA512626e085ef91b16ba1d2c7211de287854b4a7e85282ccc5a863aa3603f5249ad6dcd2ae2127142268341a5cc28d91ba4f6b9bab3bef268f35e3e683ee929bf499