Analysis
- max time kernel
96s - max time network
32s - platform
windows7_x64 - resource
win7-20240729-en - resource tags
arch:x64arch:x86image:win7-20240729-enlocale:en-usos:windows7-x64system - submitted
24/08/2024, 03:45
Behavioral task
behavioral1
Sample
0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe
Resource
win7-20240729-en
windows7-x64
12 signatures
150 seconds
General
- Target 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe
- Size 199KB
- Sample240824-ebe95stbrr
- SHA256 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889
- MD5 1876442db107de88ad1dd01cb6c764a3
- SHA1 232163c4c6e6455d22c57453166269dbf3140692
- SHA512 d8d7e12ffa90bf7b55250a0548bbc0586b132461b1e4b213e3a44cb8942c8f503c165614fc3c6ad7c1955fd216b3bdeede827ec70a98d589f88b7ded53a45432
- SSDEEP 3072:zqODUQEEqx+IlkVz1QOFTas5+U1o3I3WAc51zHT29HTBXNUpY4aqf:z5DUQEEqxnEz1lOA+UrcLHTQFXN
- MD5 SHA1 SHA512 SSDEEP
Malware Config
Signatures
- Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
- Permission Groups Discovery: Local Groups 1 TTPs
Attempt to find local system groups and permission settings.
- System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language net1.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language CMD.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language SecEdit.exe - Runs net.exe
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 288 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2984 taskmgr.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 288 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe Token: SeDebugPrivilege 2984 taskmgr.exe - Suspicious use of FindShellTrayWindow 64 IoCs
pid Process 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe - Suspicious use of SendNotifyMessage 64 IoCs
pid Process 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe 2984 taskmgr.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 288 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe - Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 288 wrote to memory of 2852 288 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe 32 PID 288 wrote to memory of 2852 288 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe 32 PID 288 wrote to memory of 2852 288 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe 32 PID 288 wrote to memory of 2852 288 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe 32 PID 2852 wrote to memory of 2736 2852 CMD.exe 34 PID 2852 wrote to memory of 2736 2852 CMD.exe 34 PID 2852 wrote to memory of 2736 2852 CMD.exe 34 PID 2852 wrote to memory of 2736 2852 CMD.exe 34 PID 2736 wrote to memory of 2684 2736 net.exe 35 PID 2736 wrote to memory of 2684 2736 net.exe 35 PID 2736 wrote to memory of 2684 2736 net.exe 35 PID 2736 wrote to memory of 2684 2736 net.exe 35 PID 288 wrote to memory of 2724 288 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe 36 PID 288 wrote to memory of 2724 288 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe 36 PID 288 wrote to memory of 2724 288 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe 36 PID 288 wrote to memory of 2724 288 0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe 36 PID 2724 wrote to memory of 316 2724 CMD.exe 38 PID 2724 wrote to memory of 316 2724 CMD.exe 38 PID 2724 wrote to memory of 316 2724 CMD.exe 38 PID 2724 wrote to memory of 316 2724 CMD.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe"C:\Users\Admin\AppData\Local\Temp\0e37b8a6711a3118daa1ce2e2f22c09b3f3c6179155b98215a1d96a81c767889.exe"1⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:288 -
C:\Windows\SysWOW64\CMD.exe"CMD.exe" /C net localgroup administrators ATMMVUser /add2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2852 -
C:\Windows\SysWOW64\net.exenet localgroup administrators ATMMVUser /add3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2736 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators ATMMVUser /add4⤵
- System Location Discovery: System Language Discovery
PID:2684
-
-
-
-
C:\Windows\SysWOW64\CMD.exe"CMD.exe" /C secedit /configure /cfg %windir%\repair\secsetup.inf /db secsetup.sdb /verbose /add2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2724 -
C:\Windows\SysWOW64\SecEdit.exesecedit /configure /cfg C:\Windows\repair\secsetup.inf /db secsetup.sdb /verbose /add3⤵
- System Location Discovery: System Language Discovery
PID:316
-
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2984
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\Log.txt
- Size 330B
- SHA256 82e656ee267d7eb751c959ccb88420ede6dabad24ccaed16c347266a3e2705b9
- MD5 b6574e9fb6ec5916a4057c33743f1538
- SHA1 5161267ace7c47decbb2188fe0f61be3267d1d60
- SHA512 5b0c2850f2d10f05adb6be6fcb1ce522f4f3af3cd312de2910e86969c63db4db14d095f1e61ef2a3e30fdf8a593a51374e2ebc917c5dc57d5b0fab9ec3661eaf
- MD5 SHA1 SHA512