Analysis
-
max time kernel
148s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
27-09-2024 20:48
Behavioral task
behavioral1
Sample
3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe
Resource
win7-20240903-en
windows7-x64
12 signatures
150 seconds
General
-
Target
3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe
-
Size
392KB
-
MD5
c59a7a48ddbf4dfbff12dfcac552eaec
-
SHA1
a65f82e74b208037cd3d8e43a4ad3ea94cb7fabc
-
SHA256
3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18
-
SHA512
cf33e7824ce3182f896588a2fb35e7e5f9543c1358d45ba3f655deafd866547ba4b2890d8240265615a8f312df3bfe671882bddb14732e4ed60a7333da4de449
-
SSDEEP
6144:ySqjfrzexKJ04rDCKJ04rDC0J04rDC8J04rDCuP:2jKKjCKjC0jC8jC
Malware Config
Signatures
-
Drops startup file 1 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\8970.lnk explorer.exe -
Executes dropped EXE 1 IoCs
pid Process 1980 explorer.exe -
Loads dropped DLL 3 IoCs
pid Process 2692 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe 2692 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe 1980 explorer.exe -
Enumerates connected drives 3 TTPs 42 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\e: explorer.exe File opened (read-only) \??\q: explorer.exe File opened (read-only) \??\g: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\j: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\k: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\y: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\t: explorer.exe File opened (read-only) \??\i: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\h: explorer.exe File opened (read-only) \??\o: explorer.exe File opened (read-only) \??\p: explorer.exe File opened (read-only) \??\x: explorer.exe File opened (read-only) \??\l: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\w: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\r: explorer.exe File opened (read-only) \??\v: explorer.exe File opened (read-only) \??\n: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\o: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\i: explorer.exe File opened (read-only) \??\n: explorer.exe File opened (read-only) \??\p: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\q: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\r: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\l: explorer.exe File opened (read-only) \??\s: explorer.exe File opened (read-only) \??\y: explorer.exe File opened (read-only) \??\h: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\m: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\z: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\m: explorer.exe File opened (read-only) \??\j: explorer.exe File opened (read-only) \??\w: explorer.exe File opened (read-only) \??\z: explorer.exe File opened (read-only) \??\s: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\t: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\v: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\g: explorer.exe File opened (read-only) \??\u: explorer.exe File opened (read-only) \??\e: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\u: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\x: 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened (read-only) \??\k: explorer.exe -
resource yara_rule behavioral1/memory/2692-0-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/files/0x0007000000012118-4.dat upx behavioral1/memory/1980-10-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/2692-30-0x0000000000400000-0x0000000000462000-memory.dmp upx behavioral1/memory/1980-38-0x0000000000400000-0x0000000000462000-memory.dmp upx -
Drops file in Program Files directory 5 IoCs
description ioc Process File created C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe File opened for modification C:\Program Files (x86)\Common Files\uiui8.dll explorer.exe File created C:\Program Files (x86)\Common Files\uiui8.dll explorer.exe File opened for modification C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe explorer.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language explorer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2692 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe 1980 explorer.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeLoadDriverPrivilege 2692 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe Token: SeLoadDriverPrivilege 1980 explorer.exe Token: SeDebugPrivilege 1980 explorer.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 1980 explorer.exe 1980 explorer.exe -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 2692 wrote to memory of 1980 2692 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe 30 PID 2692 wrote to memory of 1980 2692 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe 30 PID 2692 wrote to memory of 1980 2692 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe 30 PID 2692 wrote to memory of 1980 2692 3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe"C:\Users\Admin\AppData\Local\Temp\3f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18.exe"1⤵
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2692 -
C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe"C:\Program Files (x86)\Common Files\Microsoft Shared\explorer.exe"2⤵
- Drops startup file
- Executes dropped EXE
- Loads dropped DLL
- Enumerates connected drives
- Drops file in Program Files directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1980
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
449B
MD5ae342318b288719168082ba3f26d8e33
SHA10464e616edc87b677de3e514a5e5baf696ac92ec
SHA256331939a00efce9cab0dc7e690b7be7de0e3d2378f7ea48640bc80ead177332ec
SHA5122e7d224df58bdc39395208fae51726c6d7eff76752c1fdc746da3294b159c1b6fbc9440354ff935c41b2d18d6734cfcc6c18fb726b78fc7d73d870a32cebda34
-
Filesize
392KB
MD5c59a7a48ddbf4dfbff12dfcac552eaec
SHA1a65f82e74b208037cd3d8e43a4ad3ea94cb7fabc
SHA2563f5f7883f7341089d0c108381a72b141841b4ed6c8ba7f048a723e56ee7e7e18
SHA512cf33e7824ce3182f896588a2fb35e7e5f9543c1358d45ba3f655deafd866547ba4b2890d8240265615a8f312df3bfe671882bddb14732e4ed60a7333da4de449
-
Filesize
17KB
MD590b1f2289c3121611de1b47a54803e38
SHA18c1a78e9e777072aa60c365feb94b4eaee93ee8a
SHA25628267ad6e645fd72dcb1a218b709c85bcbe34ebb5468f9533b04ff34d7647e0c
SHA512216423e0647d4e40df227cb1bc6b6efddd2e84f5e9a58048219d7e59ec61f46e43e5e47bc4ea4485ef7af6282052113b0e68b73655c3245ec48d826fb8d905d6