cfc1155f576b0a19d0751b0ae796e7db156ebc7ee8bfa38a735d6856351e2336

Analysis

max time kernel
150s
max time network
156s
platform
windows7_x64
resource
win7-20240903-en
resource tags

arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system
submitted
24-09-2024 18:24

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

20240923_install.exe
Size

6.1MB
MD5

af3b09dc8f43ff7698b730ff6b784ad7
SHA1

64b493ed97860eb865e8d43f51c1adf81dd712c9
SHA256

afd5e03f10dbda275fc21e9e6b2387c99ee8f5977df22cd395082b9f825a2623
SHA512

edf170607e74fbbabc29ff50efb2be30baa0e12a231e9ab131380ef842ce4e7874b2e03fd6acabd2b9f05a33ee1b855c3afccc43cecfbbf2b213acae65dc6efe
SSDEEP

98304:efRnOrG2ohf0kGVrr0K4aueL2hbiD9kl7fIJJDKnD0F9OuuJFVyYU8tK:epeGjhMk60gTwbi6IoM9O3JFV5U8tK

Score

5^/10

Malware Config

Signatures

Suspicious use of SetThreadContext 2 IoCs

description	pid	Process	procid_target
PID 844 set thread context of 2052	844	svchost.exe	32
PID 2052 set thread context of 2984	2052	svchost.exe	33

Checks processor information in registry 2 TTPs 2 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CENTRALPROCESSOR\0\~MHZ	svchost.exe
Key opened	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\CENTRALPROCESSOR\0	svchost.exe

Modifies data under HKEY_USERS 5 IoCs

description	ioc	Process
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft	svchost.exe
Key created	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie	svchost.exe
Set value (int)	\REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum 64-bit\Version = "7"	svchost.exe

Suspicious behavior: EnumeratesProcesses 64 IoCs

pid	Process
2236	20240923_install.exe
2236	20240923_install.exe
2236	20240923_install.exe
2692	assist.exe
2692	assist.exe
2692	assist.exe
2216	assist.exe
2216	assist.exe
2216	assist.exe
844	svchost.exe
844	svchost.exe
2052	svchost.exe
2052	svchost.exe
2984	dllhost.exe
2984	dllhost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe
2052	svchost.exe

Suspicious use of AdjustPrivilegeToken 64 IoCs

description	pid	Process
Token: SeDebugPrivilege	2216	assist.exe
Token: SeDebugPrivilege	2216	assist.exe
Token: SeDebugPrivilege	844	svchost.exe
Token: SeDebugPrivilege	2052	svchost.exe
Token: SeDebugPrivilege	2052	svchost.exe
Token: SeDebugPrivilege	2052	svchost.exe
Token: SeDebugPrivilege	2052	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	844	svchost.exe
Token: SeIncreaseQuotaPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeTakeOwnershipPrivilege	844	svchost.exe
Token: SeLoadDriverPrivilege	844	svchost.exe
Token: SeRestorePrivilege	844	svchost.exe
Token: SeSystemEnvironmentPrivilege	844	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	844	svchost.exe
Token: SeIncreaseQuotaPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeTakeOwnershipPrivilege	844	svchost.exe
Token: SeLoadDriverPrivilege	844	svchost.exe
Token: SeSystemtimePrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeRestorePrivilege	844	svchost.exe
Token: SeShutdownPrivilege	844	svchost.exe
Token: SeSystemEnvironmentPrivilege	844	svchost.exe
Token: SeUndockPrivilege	844	svchost.exe
Token: SeManageVolumePrivilege	844	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	844	svchost.exe
Token: SeIncreaseQuotaPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeTakeOwnershipPrivilege	844	svchost.exe
Token: SeLoadDriverPrivilege	844	svchost.exe
Token: SeRestorePrivilege	844	svchost.exe
Token: SeSystemEnvironmentPrivilege	844	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	844	svchost.exe
Token: SeIncreaseQuotaPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeTakeOwnershipPrivilege	844	svchost.exe
Token: SeLoadDriverPrivilege	844	svchost.exe
Token: SeRestorePrivilege	844	svchost.exe
Token: SeSystemEnvironmentPrivilege	844	svchost.exe
Token: SeAuditPrivilege	844	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	844	svchost.exe
Token: SeIncreaseQuotaPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeTakeOwnershipPrivilege	844	svchost.exe
Token: SeLoadDriverPrivilege	844	svchost.exe
Token: SeSystemtimePrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeRestorePrivilege	844	svchost.exe
Token: SeShutdownPrivilege	844	svchost.exe
Token: SeSystemEnvironmentPrivilege	844	svchost.exe
Token: SeUndockPrivilege	844	svchost.exe
Token: SeManageVolumePrivilege	844	svchost.exe
Token: SeAssignPrimaryTokenPrivilege	844	svchost.exe
Token: SeIncreaseQuotaPrivilege	844	svchost.exe
Token: SeSecurityPrivilege	844	svchost.exe
Token: SeTakeOwnershipPrivilege	844	svchost.exe
Token: SeLoadDriverPrivilege	844	svchost.exe
Token: SeSystemtimePrivilege	844	svchost.exe
Token: SeBackupPrivilege	844	svchost.exe
Token: SeRestorePrivilege	844	svchost.exe
Token: SeShutdownPrivilege	844	svchost.exe
Token: SeSystemEnvironmentPrivilege	844	svchost.exe
Token: SeUndockPrivilege	844	svchost.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 2236 wrote to memory of 1184	2236	20240923_install.exe	21
PID 2236 wrote to memory of 1184	2236	20240923_install.exe	21
PID 2236 wrote to memory of 1184	2236	20240923_install.exe	21
PID 2236 wrote to memory of 1184	2236	20240923_install.exe	21
PID 2236 wrote to memory of 1184	2236	20240923_install.exe	21
PID 2216 wrote to memory of 844	2216	assist.exe	13
PID 2216 wrote to memory of 844	2216	assist.exe	13
PID 2216 wrote to memory of 844	2216	assist.exe	13
PID 844 wrote to memory of 2052	844	svchost.exe	32
PID 844 wrote to memory of 2052	844	svchost.exe	32
PID 844 wrote to memory of 2052	844	svchost.exe	32
PID 844 wrote to memory of 2052	844	svchost.exe	32
PID 844 wrote to memory of 2052	844	svchost.exe	32
PID 844 wrote to memory of 2052	844	svchost.exe	32
PID 2052 wrote to memory of 2984	2052	svchost.exe	33
PID 2052 wrote to memory of 2984	2052	svchost.exe	33
PID 2052 wrote to memory of 2984	2052	svchost.exe	33
PID 2052 wrote to memory of 2984	2052	svchost.exe	33
PID 2052 wrote to memory of 2984	2052	svchost.exe	33
PID 2052 wrote to memory of 2984	2052	svchost.exe	33

C:\Windows\system32\svchost.exe
C:\Windows\system32\svchost.exe -k netsvcs
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:844
- C:\Windows\system32\svchost.exe
  C:\Windows\system32\svchost.exe -k netsvcs
  2⤵
  - Suspicious use of SetThreadContext
  - Checks processor information in registry
  - Modifies data under HKEY_USERS
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:2052
- - C:\Windows\system32\dllhost.exe
    C:\Windows\system32\dllhost.exe /Processid:{F8284233-48F4-4680-ADDD-F8284233}
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    PID:2984

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
PID:1184
- C:\Users\Admin\AppData\Local\Temp\20240923_install.exe
  "C:\Users\Admin\AppData\Local\Temp\20240923_install.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of WriteProcessMemory
  PID:2236
- C:\Users\Admin\AppData\Local\Temp\assist.exe
  "C:\Users\Admin\AppData\Local\Temp\assist.exe"
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  PID:2692

C:\Program Files\Windows NT\assist.exe
"C:\Program Files\Windows NT\assist.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2216

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/844-86-0x0000000000330000-0x0000000000398000-memory.dmp

Filesize
416KB

Download
memory/844-89-0x00000000008B0000-0x00000000008B1000-memory.dmp

Filesize
4KB

Download
memory/1184-60-0x0000000007820000-0x0000000007BD8000-memory.dmp

Filesize
3.7MB

Download
memory/1184-58-0x0000000002200000-0x0000000002201000-memory.dmp

Filesize
4KB

Download
memory/1184-68-0x0000000002210000-0x0000000002211000-memory.dmp

Filesize
4KB

Download
memory/2052-112-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/2052-106-0x0000000000060000-0x0000000000061000-memory.dmp

Filesize
4KB

Download
memory/2216-93-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/2216-92-0x000007FEF7930000-0x000007FEF7BAB000-memory.dmp

Filesize
2.5MB

Download
memory/2216-77-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/2216-76-0x0000000140000000-0x00000001401AB000-memory.dmp

Filesize
1.7MB

Download
memory/2216-82-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/2216-83-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/2236-20-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-42-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-12-0x0000000001C80000-0x0000000001C8A000-memory.dmp

Filesize
40KB

Download
memory/2236-17-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-16-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-1-0x0000000001C80000-0x0000000001C8A000-memory.dmp

Filesize
40KB

Download
memory/2236-19-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-18-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-22-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-21-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-24-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-26-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-25-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-23-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-28-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-27-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-29-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-31-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-30-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-32-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-33-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-35-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-34-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-38-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-37-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-36-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-39-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-41-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-40-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-44-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-43-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-13-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-46-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-45-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-47-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-48-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-49-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-50-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-51-0x0000000001E80000-0x0000000001E81000-memory.dmp

Filesize
4KB

Download
memory/2236-52-0x0000000180000000-0x000000018000D000-memory.dmp

Filesize
52KB

Download
memory/2236-14-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-15-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-11-0x0000000001C80000-0x0000000001C8A000-memory.dmp

Filesize
40KB

Download
memory/2236-67-0x0000000001E90000-0x0000000001E9D000-memory.dmp

Filesize
52KB

Download
memory/2236-0-0x0000000001C80000-0x0000000001C8A000-memory.dmp

Filesize
40KB

Download
memory/2236-2-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-5-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-4-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-9-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-10-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-8-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2236-6-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-7-0x0000000001E90000-0x0000000001E9A000-memory.dmp

Filesize
40KB

Download
memory/2236-3-0x0000000001E80000-0x0000000001E8A000-memory.dmp

Filesize
40KB

Download
memory/2692-74-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download
memory/2692-96-0x000007FEF7930000-0x000007FEF7BAB000-memory.dmp

Filesize
2.5MB

Download
memory/2692-75-0x00000000774E1000-0x00000000775E2000-memory.dmp

Filesize
1.0MB

Download
memory/2692-70-0x0000000180000000-0x000000018006A000-memory.dmp

Filesize
424KB

Download
memory/2692-69-0x0000000140000000-0x00000001401AB000-memory.dmp

Filesize
1.7MB

Download
memory/2984-122-0x0000000000050000-0x0000000000051000-memory.dmp

Filesize
4KB

Download
memory/2984-130-0x00000000774E0000-0x0000000077689000-memory.dmp

Filesize
1.7MB

Download