Analysis
-
max time kernel
120s -
max time network
117s -
platform
windows7_x64 -
resource
win7-20240708-en -
resource tags
arch:x64arch:x86image:win7-20240708-enlocale:en-usos:windows7-x64system -
submitted
22/07/2024, 10:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
9f6655077a1757251317493f472eff90N.exe
Resource
win7-20240708-en
windows7-x64
16 signatures
120 seconds
Behavioral task
behavioral2
Sample
9f6655077a1757251317493f472eff90N.exe
Resource
win10v2004-20240709-en
windows10-2004-x64
16 signatures
120 seconds
General
-
Target
9f6655077a1757251317493f472eff90N.exe
-
Size
117KB
-
MD5
9f6655077a1757251317493f472eff90
-
SHA1
4e33de0388d6f21dce554b92c0ba697c01f45bad
-
SHA256
0d7089ccb61ac60d1923f2a511bb506f5436482c5245b3a281a93a850363bbdf
-
SHA512
a5235bd28543ec3efa83955980601be13c1796e8d979917da1d5167a362bb7ff6e8e45dbea01658cf47de4aec07e065869e62e9aca51b2508472d296bc24467e
-
SSDEEP
3072:EagwS1Ut+KNPJI1F3Md55keTZwcM2I38QXy:vUGPJKF3Md55ZTZwz38QX
Score
8/10
Malware Config
Signatures
-
Blocklisted process makes network request 4 IoCs
flow pid Process 3 2704 rundll32.exe 6 2704 rundll32.exe 7 2704 rundll32.exe 8 2704 rundll32.exe -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000e000000015cd8-13.dat acprotect -
Deletes itself 1 IoCs
pid Process 2668 wewfs.exe -
Executes dropped EXE 1 IoCs
pid Process 2668 wewfs.exe -
Loads dropped DLL 3 IoCs
pid Process 2788 cmd.exe 2788 cmd.exe 2704 rundll32.exe -
Reads user/profile data of web browsers 2 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2958949473-3205530200-1453100116-1000\Software\Microsoft\Windows\CurrentVersion\Run\EvtMgr = "c:\\windows\\SysWOW64\\rundll32.exe \"c:\\zfgjwi\\vukyk.uyv\",LoadXML" rundll32.exe -
Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\g: rundll32.exe File opened (read-only) \??\k: rundll32.exe File opened (read-only) \??\o: rundll32.exe File opened (read-only) \??\e: rundll32.exe File opened (read-only) \??\r: rundll32.exe File opened (read-only) \??\v: rundll32.exe File opened (read-only) \??\n: rundll32.exe File opened (read-only) \??\b: rundll32.exe File opened (read-only) \??\i: rundll32.exe File opened (read-only) \??\l: rundll32.exe File opened (read-only) \??\p: rundll32.exe File opened (read-only) \??\s: rundll32.exe File opened (read-only) \??\x: rundll32.exe File opened (read-only) \??\a: rundll32.exe File opened (read-only) \??\j: rundll32.exe File opened (read-only) \??\m: rundll32.exe File opened (read-only) \??\q: rundll32.exe File opened (read-only) \??\t: rundll32.exe File opened (read-only) \??\u: rundll32.exe File opened (read-only) \??\w: rundll32.exe File opened (read-only) \??\y: rundll32.exe File opened (read-only) \??\h: rundll32.exe File opened (read-only) \??\z: rundll32.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PHYSICALDRIVE0 rundll32.exe -
Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 rundll32.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString rundll32.exe -
Kills process with taskkill 1 IoCs
pid Process 2708 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2844 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe 2704 rundll32.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2704 rundll32.exe Token: SeDebugPrivilege 2708 taskkill.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 2316 9f6655077a1757251317493f472eff90N.exe 2668 wewfs.exe -
Suspicious use of WriteProcessMemory 23 IoCs
description pid Process procid_target PID 2316 wrote to memory of 2788 2316 9f6655077a1757251317493f472eff90N.exe 30 PID 2316 wrote to memory of 2788 2316 9f6655077a1757251317493f472eff90N.exe 30 PID 2316 wrote to memory of 2788 2316 9f6655077a1757251317493f472eff90N.exe 30 PID 2316 wrote to memory of 2788 2316 9f6655077a1757251317493f472eff90N.exe 30 PID 2788 wrote to memory of 2844 2788 cmd.exe 32 PID 2788 wrote to memory of 2844 2788 cmd.exe 32 PID 2788 wrote to memory of 2844 2788 cmd.exe 32 PID 2788 wrote to memory of 2844 2788 cmd.exe 32 PID 2788 wrote to memory of 2668 2788 cmd.exe 33 PID 2788 wrote to memory of 2668 2788 cmd.exe 33 PID 2788 wrote to memory of 2668 2788 cmd.exe 33 PID 2788 wrote to memory of 2668 2788 cmd.exe 33 PID 2668 wrote to memory of 2704 2668 wewfs.exe 34 PID 2668 wrote to memory of 2704 2668 wewfs.exe 34 PID 2668 wrote to memory of 2704 2668 wewfs.exe 34 PID 2668 wrote to memory of 2704 2668 wewfs.exe 34 PID 2668 wrote to memory of 2704 2668 wewfs.exe 34 PID 2668 wrote to memory of 2704 2668 wewfs.exe 34 PID 2668 wrote to memory of 2704 2668 wewfs.exe 34 PID 2704 wrote to memory of 2708 2704 rundll32.exe 35 PID 2704 wrote to memory of 2708 2704 rundll32.exe 35 PID 2704 wrote to memory of 2708 2704 rundll32.exe 35 PID 2704 wrote to memory of 2708 2704 rundll32.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\9f6655077a1757251317493f472eff90N.exe"C:\Users\Admin\AppData\Local\Temp\9f6655077a1757251317493f472eff90N.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2316 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ping 127.0.0.1 -n 2&C:\Users\Admin\AppData\Local\Temp\\wewfs.exe "C:\Users\Admin\AppData\Local\Temp\9f6655077a1757251317493f472eff90N.exe"2⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:2788 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 23⤵
- Runs ping.exe
PID:2844
-
-
C:\Users\Admin\AppData\Local\Temp\wewfs.exeC:\Users\Admin\AppData\Local\Temp\\wewfs.exe "C:\Users\Admin\AppData\Local\Temp\9f6655077a1757251317493f472eff90N.exe"3⤵
- Deletes itself
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2668 -
\??\c:\windows\SysWOW64\rundll32.exec:\windows\system32\rundll32.exe "c:\zfgjwi\vukyk.uyv",LoadXML C:\Users\Admin\AppData\Local\Temp\wewfs.exe4⤵
- Blocklisted process makes network request
- Loads dropped DLL
- Adds Run key to start application
- Enumerates connected drives
- Writes to the Master Boot Record (MBR)
- Checks processor information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2704 -
\??\c:\windows\SysWOW64\taskkill.exetaskkill /f /im attrib.exe5⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2708
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
68KB
MD5230bd5cd04a5f8ea04af339783d1bf58
SHA1803b2400b5e2146853dca3908e58f96bd554f1e0
SHA2567590edd94bd18449a3432a0054cf3e6ed53f8bd01202e1706f82f83056c0f029
SHA5129500742bc2798e94e78ae24736b51c5294e4aecce5c1e3b77151fdf04fc7ac0da8eda8be5a6a9c5cc44308eb2ea6c40902f6b4ab1d0997ece103e83a97ab0729
-
Filesize
118KB
MD59f7dd9ee33fb7ca6e217ab052f4a5d22
SHA1ceda0e4b2c41cde9a12122a97c74d51bbe9b236f
SHA256913dc23574d4f49de29ef5b5afc42c579177e29207fbeccdece9e6784fbd6ddc
SHA512a642898e670441807dd2f588b13b5f0573b0e7025353b1289afcdb39d2857172a70fbfef7f5c3d8a35b092ceb21e5f39a49fd40dc789ffa2011d48f1b75986fe