Analysis

  • max time kernel
    111s
  • max time network
    116s
  • platform
    windows7_x64
  • resource
    win7-20240704-en
  • resource tags

    arch:x64arch:x86image:win7-20240704-enlocale:en-usos:windows7-x64system
  • submitted
    21/08/2024, 09:19

General

  • Target

    422cb26a147b61b4c0c35b605cfdeb70N.exe

  • Size

    211KB

  • MD5

    422cb26a147b61b4c0c35b605cfdeb70

  • SHA1

    c3e2bb8274bab51c49a90f997151d1678a8fe1c9

  • SHA256

    b9761fe14ffb685403f490608933c0a1d0756b31f21821f50f09d10b76cf161e

  • SHA512

    075cb8271428a4b58038102c50d67e2b286b24c5af6fa3b4997cb3c8448e17ba17d053aac382e602ace4555af6ae04d407c489b3f0cec065c959eab6626fbc57

  • SSDEEP

    6144:EmKVGe1XIpQiU/ma3MB8hH2Tkp6bYnWcZVol0N5TzQ3:+71YpQiU/RcO1VQInVob

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Loads dropped DLL 2 IoCs
  • Modifies WinLogon 2 TTPs 1 IoCs
  • Drops file in Program Files directory 11 IoCs
  • Drops file in Windows directory 2 IoCs
  • System Location Discovery: System Language Discovery 1 TTPs 2 IoCs

    Attempt gather information about the system language of a victim in order to infer the geographical location of that host.

  • Modifies registry class 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 1 IoCs
  • Suspicious behavior: RenamesItself 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\422cb26a147b61b4c0c35b605cfdeb70N.exe
    "C:\Users\Admin\AppData\Local\Temp\422cb26a147b61b4c0c35b605cfdeb70N.exe"
    1⤵
    • Loads dropped DLL
    • Modifies WinLogon
    • Drops file in Windows directory
    • System Location Discovery: System Language Discovery
    • Suspicious behavior: RenamesItself
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2516
    • C:\Windows\apppatch\svchost.exe
      "C:\Windows\apppatch\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Drops file in Program Files directory
      • System Location Discovery: System Language Discovery
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      PID:2972

Network

MITRE ATT&CK Enterprise v15

Replay Monitor

Loading Replay Monitor...

Downloads

  • \Windows\AppPatch\svchost.exe

    Filesize

    211KB

    MD5

    a34297a690d40ad6fbec79dd7c85083d

    SHA1

    3b581d5fb074d63fa9fdd4a784a082cedbd201d2

    SHA256

    4cbd752825ae18b49204912b46ba9e24b0801d229a0626aadea7e4b37289948a

    SHA512

    663239c8b4bdc53ed0aa4178e094f2fc65a76339fa0d5fe947a04c83582d7161d89cf8dff6731538a28ceba3ce998990de7411ca6df5830386166165a5445c06

  • memory/2516-0-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2516-1-0x0000000000360000-0x00000000003B2000-memory.dmp

    Filesize

    328KB

  • memory/2516-2-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2516-21-0x0000000000400000-0x000000000045F000-memory.dmp

    Filesize

    380KB

  • memory/2516-19-0x0000000000360000-0x00000000003B2000-memory.dmp

    Filesize

    328KB

  • memory/2516-18-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2972-20-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2972-22-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2972-23-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2972-24-0x0000000002250000-0x00000000022FA000-memory.dmp

    Filesize

    680KB

  • memory/2972-26-0x0000000002250000-0x00000000022FA000-memory.dmp

    Filesize

    680KB

  • memory/2972-34-0x0000000002250000-0x00000000022FA000-memory.dmp

    Filesize

    680KB

  • memory/2972-32-0x0000000002250000-0x00000000022FA000-memory.dmp

    Filesize

    680KB

  • memory/2972-35-0x0000000000400000-0x000000000049B000-memory.dmp

    Filesize

    620KB

  • memory/2972-30-0x0000000002250000-0x00000000022FA000-memory.dmp

    Filesize

    680KB

  • memory/2972-29-0x0000000002250000-0x00000000022FA000-memory.dmp

    Filesize

    680KB

  • memory/2972-36-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-38-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-41-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-43-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-52-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-70-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-86-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-85-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-84-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-83-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-82-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-81-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-80-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-79-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-78-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-77-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-76-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-75-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-74-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-73-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-72-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-71-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-69-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-68-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-67-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-66-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-65-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-64-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-63-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-62-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-61-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-60-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-59-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-58-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-57-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-56-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-55-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-54-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-53-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-51-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-50-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-49-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-48-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-47-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-46-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-42-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-45-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB

  • memory/2972-44-0x0000000002810000-0x00000000028C7000-memory.dmp

    Filesize

    732KB