Analysis
-
max time kernel
144s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
16-09-2024 18:36
Static task
static1
Behavioral task
behavioral1
Sample
artifact.exe
Resource
win7-20240903-en
General
-
Target
artifact.exe
-
Size
178KB
-
MD5
22a91930458ed41136ef88cd7fd978c3
-
SHA1
a20015e3e22ada90ba646e2ab6c4d2ae7d1c3dfb
-
SHA256
7b14a5c267d51a533b1d77b557b03c3437e7e59f699deafbb6c196cbdf38d931
-
SHA512
6e4dd8356ab809c6d9a76fa90e7a3909917cd8035404e09046fa3e3a8ec215f6932edf5097d3603c7c68ba3e084fd8aeb038bd7b98fd32f725deae5a49cae600
-
SSDEEP
3072:AwR8p6hiq3EyQIrZhbSJKbsQvVqRlkM4OAD/KLznBuB2JA2BjcH:AwR8p68qUY5bsQvMRlkM4RD/qzMfUi
Malware Config
Signatures
-
Modifies visibility of file extensions in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\HideFileExt = "1" artifact.exe -
Modifies visiblity of hidden/system files in Explorer 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced\ShowSuperHidden = "0" artifact.exe -
Detects Floxif payload 1 IoCs
resource yara_rule behavioral1/files/0x000b000000012281-2.dat floxif -
ACProtect 1.3x - 1.4x DLL software 1 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral1/files/0x000b000000012281-2.dat acprotect -
Loads dropped DLL 1 IoCs
pid Process 2208 artifact.exe -
resource yara_rule behavioral1/files/0x000b000000012281-2.dat upx behavioral1/memory/2208-4-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2208-11-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2208-12-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2208-19-0x0000000010000000-0x0000000010033000-memory.dmp upx behavioral1/memory/2208-22-0x0000000010000000-0x0000000010033000-memory.dmp upx -
Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: artifact.exe -
pid Process 2484 arp.exe 2424 arp.exe 2652 arp.exe 1108 arp.exe 2504 arp.exe 2336 arp.exe 2352 arp.exe 2340 arp.exe 2836 arp.exe -
Drops file in Program Files directory 2 IoCs
description ioc Process File created C:\Program Files\Common Files\System\symsrv.dll artifact.exe File created \??\c:\program files\common files\system\symsrv.dll.000 artifact.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 11 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language artifact.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language arp.exe -
Modifies registry class 27 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\MRUListEx = 00000000ffffffff artifact.exe Set value (int) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\NodeSlot = "1" artifact.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1 artifact.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_Classes\Local Settings artifact.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 artifact.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\MRUListEx = 00000000ffffffff artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 = 4a0031000000000000000000100054656d700000360008000400efbe00000000000000002a00000000000000000000000000000000000000000000000000540065006d007000000014000000 artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 artifact.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\MRUListEx = 00000000ffffffff artifact.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 artifact.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0\MRUListEx = ffffffff artifact.exe Set value (str) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags\1\Shell\KnownFolderDerivedFolderType = "{57807898-8C4F-4462-BB63-71042380B109}" artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0\0 = 5600310000000000000000001700617274696661637400003e0008000400efbe00000000000000002a0000000000000000000000000000000000000000000000000061007200740069006600610063007400000018000000 artifact.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\Bags artifact.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0 = 7e0074001c0043465346160031000000000000000000100041707044617461000000741a595e96dfd3488d671733bcee28bac5cdfadf9f6756418947c5c76bc0b67f3c0008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004100700070004400610074006100000042000000 artifact.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0\0 artifact.exe Key created \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0 = 14001f44471a0359723fa74489c55595fe6b30ee0000 artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\MRUListEx = 00000000ffffffff artifact.exe Set value (data) \REGISTRY\USER\S-1-5-21-4177215427-74451935-3209572229-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\0\0\0 = 4c003100000000000000000010004c6f63616c00380008000400efbe00000000000000002a000000000000000000000000000000000000000000000000004c006f00630061006c00000014000000 artifact.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
pid Process 2208 artifact.exe 2208 artifact.exe 2208 artifact.exe 2208 artifact.exe -
Suspicious behavior: LoadsDriver 2 IoCs
pid Process 476 Process not Found 476 Process not Found -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2208 artifact.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2208 wrote to memory of 2484 2208 artifact.exe 31 PID 2208 wrote to memory of 2484 2208 artifact.exe 31 PID 2208 wrote to memory of 2484 2208 artifact.exe 31 PID 2208 wrote to memory of 2484 2208 artifact.exe 31 PID 2208 wrote to memory of 2336 2208 artifact.exe 33 PID 2208 wrote to memory of 2336 2208 artifact.exe 33 PID 2208 wrote to memory of 2336 2208 artifact.exe 33 PID 2208 wrote to memory of 2336 2208 artifact.exe 33 PID 2208 wrote to memory of 2340 2208 artifact.exe 34 PID 2208 wrote to memory of 2340 2208 artifact.exe 34 PID 2208 wrote to memory of 2340 2208 artifact.exe 34 PID 2208 wrote to memory of 2340 2208 artifact.exe 34 PID 2208 wrote to memory of 2352 2208 artifact.exe 36 PID 2208 wrote to memory of 2352 2208 artifact.exe 36 PID 2208 wrote to memory of 2352 2208 artifact.exe 36 PID 2208 wrote to memory of 2352 2208 artifact.exe 36 PID 2208 wrote to memory of 2424 2208 artifact.exe 38 PID 2208 wrote to memory of 2424 2208 artifact.exe 38 PID 2208 wrote to memory of 2424 2208 artifact.exe 38 PID 2208 wrote to memory of 2424 2208 artifact.exe 38 PID 2208 wrote to memory of 2836 2208 artifact.exe 40 PID 2208 wrote to memory of 2836 2208 artifact.exe 40 PID 2208 wrote to memory of 2836 2208 artifact.exe 40 PID 2208 wrote to memory of 2836 2208 artifact.exe 40 PID 2208 wrote to memory of 2652 2208 artifact.exe 41 PID 2208 wrote to memory of 2652 2208 artifact.exe 41 PID 2208 wrote to memory of 2652 2208 artifact.exe 41 PID 2208 wrote to memory of 2652 2208 artifact.exe 41 PID 2208 wrote to memory of 1108 2208 artifact.exe 42 PID 2208 wrote to memory of 1108 2208 artifact.exe 42 PID 2208 wrote to memory of 1108 2208 artifact.exe 42 PID 2208 wrote to memory of 1108 2208 artifact.exe 42 PID 2208 wrote to memory of 2504 2208 artifact.exe 43 PID 2208 wrote to memory of 2504 2208 artifact.exe 43 PID 2208 wrote to memory of 2504 2208 artifact.exe 43 PID 2208 wrote to memory of 2504 2208 artifact.exe 43 PID 2208 wrote to memory of 1984 2208 artifact.exe 49 PID 2208 wrote to memory of 1984 2208 artifact.exe 49 PID 2208 wrote to memory of 1984 2208 artifact.exe 49 PID 2208 wrote to memory of 1984 2208 artifact.exe 49
Processes
-
C:\Users\Admin\AppData\Local\Temp\artifact.exe"C:\Users\Admin\AppData\Local\Temp\artifact.exe"1⤵
- Modifies visibility of file extensions in Explorer
- Modifies visiblity of hidden/system files in Explorer
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2208 -
C:\Windows\SysWOW64\arp.exearp -a2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2484
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.0.1 1f-3c-2b-a7-b4-032⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2336
-
-
C:\Windows\SysWOW64\arp.exearp -s 10.127.255.255 79-23-67-37-4a-612⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2340
-
-
C:\Windows\SysWOW64\arp.exearp -s 37.27.61.183 00-b5-ba-32-23-852⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2352
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.22 01-1e-1b-7f-a9-a02⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2424
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.251 ef-b1-62-11-ae-422⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2836
-
-
C:\Windows\SysWOW64\arp.exearp -s 224.0.0.252 81-ac-35-c8-52-e82⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2652
-
-
C:\Windows\SysWOW64\arp.exearp -s 239.255.255.250 6c-d6-51-d8-5d-062⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:1108
-
-
C:\Windows\SysWOW64\arp.exearp -s 255.255.255.255 99-3d-75-4e-95-6c2⤵
- Network Service Discovery
- System Location Discovery: System Language Discovery
PID:2504
-
-
C:\Windows\SysWOW64\arp.exearp -d2⤵
- System Location Discovery: System Language Discovery
PID:1984
-
Network
MITRE ATT&CK Enterprise v15
Defense Evasion
Hide Artifacts
2Hidden Files and Directories
2Modify Registry
2Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
71KB
MD54fcd7574537cebec8e75b4e646996643
SHA1efa59bb9050fb656b90d5d40c942fb2a304f2a8b
SHA2568ea3b17e4b783ffc0bc387b81b823bf87af0d57da74541d88ba85314bb232a5d
SHA5127f1a7ef64d332a735db82506b47d84853af870785066d29ccaf4fdeab114079a9f0db400e01ba574776a0d652a248658fe1e8f9659cdced19ad6eea09644ea3e