Analysis
-
max time kernel
119s -
max time network
17s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
19/09/2024, 02:39
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe
Resource
win7-20240903-en
windows7-x64
10 signatures
120 seconds
Behavioral task
behavioral2
Sample
515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe
Resource
win10v2004-20240802-en
windows10-2004-x64
10 signatures
120 seconds
General
-
Target
515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe
-
Size
524KB
-
MD5
558477de7e2544d2677b45f9fc74cf40
-
SHA1
ca7254d58a4ca548e840ff9299b49dad8875aa9a
-
SHA256
515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1
-
SHA512
5b536c163dd3571af1130cd6a010644865dfad86884455b157e0ccfad26cc59114964ef2320ec0642b3c681ff82c82af569e01485b08a51adf1a6df572337246
-
SSDEEP
12288:LLS65eo7WOcg3kXaD5Ny6+KW78FCjIwQpe:LLS65eKWOpkXaLy6OECXQpe
Score
7/10
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
pid Process 1808 WindowsService.exe 948 WindowsService.exe -
Loads dropped DLL 5 IoCs
pid Process 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe -
resource yara_rule behavioral1/memory/2576-298-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2576-340-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/2576-618-0x0000000000400000-0x000000000040B000-memory.dmp upx behavioral1/memory/948-620-0x0000000000400000-0x000000000040B000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-312935884-697965778-3955649944-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsService = "C:\\Users\\Admin\\AppData\\Roaming\\SystemWindowsWindowsService\\WindowsService.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 1920 set thread context of 2576 1920 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 30 PID 1808 set thread context of 948 1808 WindowsService.exe 36 PID 1808 set thread context of 0 1808 WindowsService.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language reg.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language WindowsService.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe Token: SeDebugPrivilege 948 WindowsService.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1920 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 1808 WindowsService.exe 948 WindowsService.exe -
Suspicious use of WriteProcessMemory 28 IoCs
description pid Process procid_target PID 1920 wrote to memory of 2576 1920 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 30 PID 1920 wrote to memory of 2576 1920 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 30 PID 1920 wrote to memory of 2576 1920 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 30 PID 1920 wrote to memory of 2576 1920 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 30 PID 1920 wrote to memory of 2576 1920 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 30 PID 1920 wrote to memory of 2576 1920 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 30 PID 1920 wrote to memory of 2576 1920 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 30 PID 1920 wrote to memory of 2576 1920 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 30 PID 2576 wrote to memory of 2304 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 31 PID 2576 wrote to memory of 2304 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 31 PID 2576 wrote to memory of 2304 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 31 PID 2576 wrote to memory of 2304 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 31 PID 2304 wrote to memory of 1784 2304 cmd.exe 33 PID 2304 wrote to memory of 1784 2304 cmd.exe 33 PID 2304 wrote to memory of 1784 2304 cmd.exe 33 PID 2304 wrote to memory of 1784 2304 cmd.exe 33 PID 2576 wrote to memory of 1808 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 34 PID 2576 wrote to memory of 1808 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 34 PID 2576 wrote to memory of 1808 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 34 PID 2576 wrote to memory of 1808 2576 515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe 34 PID 1808 wrote to memory of 948 1808 WindowsService.exe 36 PID 1808 wrote to memory of 948 1808 WindowsService.exe 36 PID 1808 wrote to memory of 948 1808 WindowsService.exe 36 PID 1808 wrote to memory of 948 1808 WindowsService.exe 36 PID 1808 wrote to memory of 948 1808 WindowsService.exe 36 PID 1808 wrote to memory of 948 1808 WindowsService.exe 36 PID 1808 wrote to memory of 948 1808 WindowsService.exe 36 PID 1808 wrote to memory of 948 1808 WindowsService.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe"C:\Users\Admin\AppData\Local\Temp\515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1920 -
C:\Users\Admin\AppData\Local\Temp\515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe"C:\Users\Admin\AppData\Local\Temp\515ec1ce3e6c81c23dbd56cc782f93a8c770950f53a6a7689477568d7cf1ffe1N.exe"2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\UMABV.bat" "3⤵
- System Location Discovery: System Language Discovery
- Suspicious use of WriteProcessMemory
PID:2304 -
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /v "WindowsService" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe" /f4⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:1784
-
-
-
C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1808 -
C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"C:\Users\Admin\AppData\Roaming\SystemWindowsWindowsService\WindowsService.exe"4⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:948
-
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
178B
MD5c2cc427c87f0a6e231266dbb4d5b6ac5
SHA1e0849fc705f915d218b2dc2f744bb24157022355
SHA2561b985a6f00b15b5eb13fd2b9c79f163e2c3ed1b8d4133e08f213dc6dc7850999
SHA512be4d6b172b0c92d1ffa33b30c642db3ccbda637af92234853918ef5e3c6c40121ec10c42557c96ddbc234d0d539c47c6c5adc8bf4c77e9daf8204661215a8e37
-
Filesize
524KB
MD582fc57ef0cb8ead760cbb5511cfeba27
SHA156e955061fa53b744cd6444f80e688bbb0bd4cba
SHA256b321caeb2602d986ce4877ac33880389dd8298d87c9ed034a9553da8245e9a9c
SHA512c0bd3b43668860220c32d0aeebd2f3299c8ae2e1e72e3f837b4c95159e861b57633ef3f72020bb0a486165e5db8673d6c5f796cb3f5711ebec840e809bf0839d