Analysis
-
max time kernel
120s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
03/09/2024, 20:48
Behavioral task
behavioral1
Sample
cb5e3b56f8724fd8efcfc57633fb2980N.exe
Resource
win7-20240903-en
windows7-x64
11 signatures
120 seconds
General
-
Target
cb5e3b56f8724fd8efcfc57633fb2980N.exe
-
Size
4.5MB
-
MD5
cb5e3b56f8724fd8efcfc57633fb2980
-
SHA1
99a4a87d94a1e7760ee1ca5039e6b5a79d342010
-
SHA256
d82e82550673b3a0bc627c4d3ba6c2ebb9b686eda161ae5d26f95a3720d8c8ec
-
SHA512
2fdfedd48e4e76e4c7b9d5f9a2a1a28da505d6e894f98023f2823faf97c937b189ac26410732bd62891069d87723515edcb55bcf83b5725997bd4f369593219b
-
SSDEEP
98304:W3AuxziZNLsJvb0qKMbDgYlARHHMt01wjIm4rJwaUI0sRUUckyoXII:uTzoJAbP3Dg1wErRUjscoX
Malware Config
Signatures
-
resource yara_rule behavioral1/memory/2260-0-0x0000000001270000-0x0000000001BFA000-memory.dmp vmprotect behavioral1/memory/2260-10-0x0000000001270000-0x0000000001BFA000-memory.dmp vmprotect behavioral1/memory/2260-14-0x0000000001270000-0x0000000001BFA000-memory.dmp vmprotect behavioral1/memory/2260-20-0x0000000001270000-0x0000000001BFA000-memory.dmp vmprotect behavioral1/memory/2260-21-0x0000000001270000-0x0000000001BFA000-memory.dmp vmprotect -
Suspicious use of NtSetInformationThreadHideFromDebugger 1 IoCs
pid Process 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe -
Drops file in Windows directory 3 IoCs
description ioc Process File created C:\Windows\HYDati.dll cb5e3b56f8724fd8efcfc57633fb2980N.exe File created C:\Windows\mydll.dll cb5e3b56f8724fd8efcfc57633fb2980N.exe File created C:\Windows\Ldll.dll cb5e3b56f8724fd8efcfc57633fb2980N.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cb5e3b56f8724fd8efcfc57633fb2980N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cacls.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language attrib.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language ipconfig.exe -
Gathers network information 2 TTPs 2 IoCs
Uses commandline utility to view network configuration.
pid Process 2824 ipconfig.exe 2896 ipconfig.exe -
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main cb5e3b56f8724fd8efcfc57633fb2980N.exe Key created \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch cb5e3b56f8724fd8efcfc57633fb2980N.exe Set value (str) \REGISTRY\USER\S-1-5-21-3290804112-2823094203-3137964600-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" cb5e3b56f8724fd8efcfc57633fb2980N.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
pid Process 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2260 wrote to memory of 1332 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 30 PID 2260 wrote to memory of 1332 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 30 PID 2260 wrote to memory of 1332 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 30 PID 2260 wrote to memory of 1332 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 30 PID 2260 wrote to memory of 2160 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 31 PID 2260 wrote to memory of 2160 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 31 PID 2260 wrote to memory of 2160 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 31 PID 2260 wrote to memory of 2160 2260 cb5e3b56f8724fd8efcfc57633fb2980N.exe 31 PID 1332 wrote to memory of 1624 1332 cmd.exe 34 PID 1332 wrote to memory of 1624 1332 cmd.exe 34 PID 1332 wrote to memory of 1624 1332 cmd.exe 34 PID 1332 wrote to memory of 1624 1332 cmd.exe 34 PID 1332 wrote to memory of 2788 1332 cmd.exe 35 PID 1332 wrote to memory of 2788 1332 cmd.exe 35 PID 1332 wrote to memory of 2788 1332 cmd.exe 35 PID 1332 wrote to memory of 2788 1332 cmd.exe 35 PID 2160 wrote to memory of 2096 2160 cmd.exe 36 PID 2160 wrote to memory of 2096 2160 cmd.exe 36 PID 2160 wrote to memory of 2096 2160 cmd.exe 36 PID 2160 wrote to memory of 2096 2160 cmd.exe 36 PID 2160 wrote to memory of 2468 2160 cmd.exe 37 PID 2160 wrote to memory of 2468 2160 cmd.exe 37 PID 2160 wrote to memory of 2468 2160 cmd.exe 37 PID 2160 wrote to memory of 2468 2160 cmd.exe 37 PID 1332 wrote to memory of 700 1332 cmd.exe 38 PID 1332 wrote to memory of 700 1332 cmd.exe 38 PID 1332 wrote to memory of 700 1332 cmd.exe 38 PID 1332 wrote to memory of 700 1332 cmd.exe 38 PID 2160 wrote to memory of 2712 2160 cmd.exe 39 PID 2160 wrote to memory of 2712 2160 cmd.exe 39 PID 2160 wrote to memory of 2712 2160 cmd.exe 39 PID 2160 wrote to memory of 2712 2160 cmd.exe 39 PID 2160 wrote to memory of 2896 2160 cmd.exe 40 PID 2160 wrote to memory of 2896 2160 cmd.exe 40 PID 2160 wrote to memory of 2896 2160 cmd.exe 40 PID 2160 wrote to memory of 2896 2160 cmd.exe 40 PID 1332 wrote to memory of 2824 1332 cmd.exe 41 PID 1332 wrote to memory of 2824 1332 cmd.exe 41 PID 1332 wrote to memory of 2824 1332 cmd.exe 41 PID 1332 wrote to memory of 2824 1332 cmd.exe 41 -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 700 attrib.exe 2712 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cb5e3b56f8724fd8efcfc57633fb2980N.exe"C:\Users\Admin\AppData\Local\Temp\cb5e3b56f8724fd8efcfc57633fb2980N.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2260 -
C:\Windows\SysWOW64\cmd.execmd.exe /c ECHO y|cacls %windir%\System32\drivers\etc\hosts /g everyone:f & attrib /s /d -s -h %windir%\System32\drivers\etc\hosts & move hosts %windir%\System32\drivers\etc\ & ipconfig /flushdns2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:1332 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO y"3⤵
- System Location Discovery: System Language Discovery
PID:1624
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\System32\drivers\etc\hosts /g everyone:f3⤵
- System Location Discovery: System Language Discovery
PID:2788
-
-
C:\Windows\SysWOW64\attrib.exeattrib /s /d -s -h C:\Windows\System32\drivers\etc\hosts3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:700
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:2824
-
-
-
C:\Windows\SysWOW64\cmd.execmd.exe /c ECHO y|cacls %windir%\System32\drivers\etc\hosts /g everyone:f & attrib /s /d -s -h %windir%\System32\drivers\etc\hosts & move hosts %windir%\System32\drivers\etc\ & ipconfig /flushdns2⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2160 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /S /D /c" ECHO y"3⤵
- System Location Discovery: System Language Discovery
PID:2096
-
-
C:\Windows\SysWOW64\cacls.execacls C:\Windows\System32\drivers\etc\hosts /g everyone:f3⤵
- System Location Discovery: System Language Discovery
PID:2468
-
-
C:\Windows\SysWOW64\attrib.exeattrib /s /d -s -h C:\Windows\System32\drivers\etc\hosts3⤵
- System Location Discovery: System Language Discovery
- Views/modifies file attributes
PID:2712
-
-
C:\Windows\SysWOW64\ipconfig.exeipconfig /flushdns3⤵
- System Location Discovery: System Language Discovery
- Gathers network information
PID:2896
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
977B
MD553316bc0c42b9d65743709021f1d03c7
SHA144cfe377bf7fedee2ce8f888cfacefd283e924e6
SHA256600d914eb6b9ffb387be5b7300ca138192a4e86c4679c9bff36bcf0364e74b36
SHA5129b390f6d7955413c8d63d02dff6988442cf78bbfb72e12f7deab56b190c1a7f455c5af3344ee5a1f7477d383c24e567af4fb7639ab6d9f014935418bf1cf00f6