Analysis
-
max time kernel
119s -
max time network
119s -
platform
windows7_x64 -
resource
win7-20240704-en -
resource tags
arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system -
submitted
17-08-2024 20:19
Behavioral task
behavioral1
Sample
9b50e0fc98472269eaef7ae439af8330N.exe
Resource
win7-20240704-en
General
-
Target
9b50e0fc98472269eaef7ae439af8330N.exe
-
Size
392KB
-
MD5
9b50e0fc98472269eaef7ae439af8330
-
SHA1
bf6c17e5b7bff376ea6a27885929a59d444ff6ba
-
SHA256
5d4cb9ce0d30179015c08a55968b74a09158578b84c652a0d31cd7e5fef52897
-
SHA512
effd931d1fd6bbaa6ed57c87512b43009d612cbdf7f012bbfc1623c6055ac6d7722c06408260feed8d59fc9406c5ef03cd5f195a1d4cd81d0d88c0d098f9f054
-
SSDEEP
3072:V+ESQ0EWVwZhKxC5Rt+k60Zh+qw6PYSsszfHZTZJ2lbaV2:DPA6wxmuJspr2lb6
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\12691 = "C:\\PROGRA~3\\LOCALS~1\\Temp\\mswufr.cmd" svchost.exe -
Executes dropped EXE 3 IoCs
pid Process 4312 skyrpe.exe 179104 skyrpe.exe 179164 skyrpe.exe -
Loads dropped DLL 5 IoCs
pid Process 4108 9b50e0fc98472269eaef7ae439af8330N.exe 4108 9b50e0fc98472269eaef7ae439af8330N.exe 4108 9b50e0fc98472269eaef7ae439af8330N.exe 4108 9b50e0fc98472269eaef7ae439af8330N.exe 4108 9b50e0fc98472269eaef7ae439af8330N.exe -
resource yara_rule behavioral1/memory/2056-0-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/2056-223-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/4108-53483-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/4108-53485-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/4108-53489-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2056-53491-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/4108-53490-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/4108-53492-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/files/0x0033000000016cdf-53517.dat upx behavioral1/memory/4312-53535-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/4108-53687-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/4312-53692-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/4312-106980-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/4108-106983-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3434294380-2554721341-1919518612-1000\Software\Microsoft\Windows\CurrentVersion\Run\Skype = "C:\\Users\\Admin\\AppData\\Roaming\\skype\\skyrpe.exe" reg.exe -
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\disk\enum skyrpe.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 skyrpe.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2056 set thread context of 4108 2056 9b50e0fc98472269eaef7ae439af8330N.exe 31 PID 4312 set thread context of 179104 4312 skyrpe.exe 36 PID 4312 set thread context of 179164 4312 skyrpe.exe 37 -
Drops file in Program Files directory 1 IoCs
description ioc Process File created C:\PROGRA~3\LOCALS~1\Temp\mswufr.cmd svchost.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 8 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b50e0fc98472269eaef7ae439af8330N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skyrpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skyrpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language skyrpe.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 9b50e0fc98472269eaef7ae439af8330N.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 179164 skyrpe.exe -
Suspicious behavior: MapViewOfSection 1 IoCs
pid Process 179164 skyrpe.exe -
Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe Token: SeDebugPrivilege 179104 skyrpe.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2056 9b50e0fc98472269eaef7ae439af8330N.exe 4108 9b50e0fc98472269eaef7ae439af8330N.exe 4312 skyrpe.exe 179104 skyrpe.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 2056 wrote to memory of 4108 2056 9b50e0fc98472269eaef7ae439af8330N.exe 31 PID 2056 wrote to memory of 4108 2056 9b50e0fc98472269eaef7ae439af8330N.exe 31 PID 2056 wrote to memory of 4108 2056 9b50e0fc98472269eaef7ae439af8330N.exe 31 PID 2056 wrote to memory of 4108 2056 9b50e0fc98472269eaef7ae439af8330N.exe 31 PID 2056 wrote to memory of 4108 2056 9b50e0fc98472269eaef7ae439af8330N.exe 31 PID 2056 wrote to memory of 4108 2056 9b50e0fc98472269eaef7ae439af8330N.exe 31 PID 2056 wrote to memory of 4108 2056 9b50e0fc98472269eaef7ae439af8330N.exe 31 PID 2056 wrote to memory of 4108 2056 9b50e0fc98472269eaef7ae439af8330N.exe 31 PID 4108 wrote to memory of 4236 4108 9b50e0fc98472269eaef7ae439af8330N.exe 32 PID 4108 wrote to memory of 4236 4108 9b50e0fc98472269eaef7ae439af8330N.exe 32 PID 4108 wrote to memory of 4236 4108 9b50e0fc98472269eaef7ae439af8330N.exe 32 PID 4108 wrote to memory of 4236 4108 9b50e0fc98472269eaef7ae439af8330N.exe 32 PID 4236 wrote to memory of 4292 4236 cmd.exe 34 PID 4236 wrote to memory of 4292 4236 cmd.exe 34 PID 4236 wrote to memory of 4292 4236 cmd.exe 34 PID 4236 wrote to memory of 4292 4236 cmd.exe 34 PID 4108 wrote to memory of 4312 4108 9b50e0fc98472269eaef7ae439af8330N.exe 35 PID 4108 wrote to memory of 4312 4108 9b50e0fc98472269eaef7ae439af8330N.exe 35 PID 4108 wrote to memory of 4312 4108 9b50e0fc98472269eaef7ae439af8330N.exe 35 PID 4108 wrote to memory of 4312 4108 9b50e0fc98472269eaef7ae439af8330N.exe 35 PID 4312 wrote to memory of 179104 4312 skyrpe.exe 36 PID 4312 wrote to memory of 179104 4312 skyrpe.exe 36 PID 4312 wrote to memory of 179104 4312 skyrpe.exe 36 PID 4312 wrote to memory of 179104 4312 skyrpe.exe 36 PID 4312 wrote to memory of 179104 4312 skyrpe.exe 36 PID 4312 wrote to memory of 179104 4312 skyrpe.exe 36 PID 4312 wrote to memory of 179104 4312 skyrpe.exe 36 PID 4312 wrote to memory of 179104 4312 skyrpe.exe 36 PID 4312 wrote to memory of 179164 4312 skyrpe.exe 37 PID 4312 wrote to memory of 179164 4312 skyrpe.exe 37 PID 4312 wrote to memory of 179164 4312 skyrpe.exe 37 PID 4312 wrote to memory of 179164 4312 skyrpe.exe 37 PID 4312 wrote to memory of 179164 4312 skyrpe.exe 37 PID 4312 wrote to memory of 179164 4312 skyrpe.exe 37 PID 4312 wrote to memory of 179164 4312 skyrpe.exe 37 PID 179164 wrote to memory of 34888 179164 skyrpe.exe 38 PID 179164 wrote to memory of 34888 179164 skyrpe.exe 38 PID 179164 wrote to memory of 34888 179164 skyrpe.exe 38 PID 179164 wrote to memory of 34888 179164 skyrpe.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b50e0fc98472269eaef7ae439af8330N.exe"C:\Users\Admin\AppData\Local\Temp\9b50e0fc98472269eaef7ae439af8330N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Users\Admin\AppData\Local\Temp\9b50e0fc98472269eaef7ae439af8330N.exe"C:\Users\Admin\AppData\Local\Temp\9b50e0fc98472269eaef7ae439af8330N.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4108 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\RVHFJ.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:4236 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "Skype" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:4292
-
-
-
C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4312 -
C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:179104
-
-
C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"C:\Users\Admin\AppData\Roaming\skype\skyrpe.exe"4⤵
- Executes dropped EXE
- Maps connected drives based on registry
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:179164 -
C:\Windows\syswow64\svchost.exeC:\Windows\syswow64\svchost.exe5⤵
- Adds policy Run key to start application
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
PID:34888
-
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
139B
MD50654f004b2e314bad7f75867e91da37d
SHA14232c22e7340b12108d86e3cb35ed288a3dbc7f1
SHA256ead325a060300a9606a3f0f14694be39a3e4006a60c6c3eb0bea5d6f98192249
SHA512dda135cdfca90a742d42b4c7a5e7f5df6580ec428302a8f0c311f5b92eb08dda75774e0c7497110faffbe2dfa02b30d2dfe35ec2848a275f53be8d930c7aa553
-
Filesize
392KB
MD5c67553c2c8519400da4fc018f3e69c26
SHA1840257fec9b0b661da3f46d1251ca1b40e0f6761
SHA2560fa2b9fb97d9e8e0a4300b6d1508af237a273ace5c5995a96a0744d834655da3
SHA512a75ecf78849c56e1f3acdba3f90db2a2084668d1a2233693e2cc75fc9751e2d9c41f938aa4e97727ad0981313c1f7b8777340ca16f6adb855ea822b7a159f50f