Analysis
- max time kernel
120s - max time network
96s - platform
windows10-2004_x64 - resource
win10v2004-20241007-en - resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system - submitted
11/11/2024, 11:07
Behavioral task
behavioral1
Sample
b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe
Resource
win7-20240708-en
windows7-x64
11 signatures
120 seconds
Behavioral task
behavioral2
Sample
b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
120 seconds
General
- Target b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe
- Size 119KB
- Sample241111-m73djsydml
- SHA256 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a
- MD5 735c669602386c4bc5910d9c34f28ae4
- SHA1 d4c491828f4d234228b38eba0a55ad56b2fc8538
- SHA512 7d278bd6a70e8ae4ffa9caf83454a7bef2fa801d0026efc6f155bc6ad419d2fafa168a453f94a7fd8f814d8b530ee5891e4ce30a3d4fb1645a2c90af03e803e2
- SSDEEP 3072:QSM+4qCYLw4QhsuU23jUVeVyYwlK637C9mwDrOeqF:QSM9qCYL2rU2YCwU6OZA
- MD5 SHA1 SHA512 SSDEEP
Score
8/10
Malware Config
Signatures
- Drops file in Drivers directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\drivers\spools.exe b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe File opened for modification C:\Windows\SysWOW64\drivers\spools.exe b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe - Sets service image path in registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Schedule\ImagePath = "C:\\Windows\\system32\\drivers\\spools.exe" b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe - ACProtect 1.3x - 1.4x DLL software 3 IoCs
Detects file using ACProtect software.
resource yara_rule behavioral2/files/0x000e000000023ad0-9.dat acprotect behavioral2/memory/3468-12-0x0000000010000000-0x000000001010B000-memory.dmp acprotect behavioral2/memory/3468-15-0x0000000010000000-0x000000001010B000-memory.dmp acprotect - Loads dropped DLL 1 IoCs
pid Process 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe Set value (str) \REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\autoload = "C:\\Users\\Admin\\Local Settings\\Application Data\\cftmon.exe" b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\ntuser = "C:\\Windows\\system32\\drivers\\spools.exe" b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe - Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64\ftpdll.dll b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe -
resource yara_rule behavioral2/memory/3468-0-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/files/0x00050000000230d8-5.dat upx behavioral2/files/0x000e000000023ad0-9.dat upx behavioral2/memory/3468-12-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/3468-13-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3468-14-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3700-16-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3468-15-0x0000000010000000-0x000000001010B000-memory.dmp upx behavioral2/memory/4672-18-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3248-20-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/4672-19-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3248-21-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3468-22-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3468-27-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3700-29-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3468-32-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3468-37-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3468-42-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3468-52-0x0000000000400000-0x0000000000425000-memory.dmp upx behavioral2/memory/3468-57-0x0000000000400000-0x0000000000425000-memory.dmp upx - System Location Discovery: System Language Discovery 1 TTPs 2 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3700 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3700 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 4672 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 4672 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 3468 wrote to memory of 3700 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 87 PID 3468 wrote to memory of 3700 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 87 PID 3468 wrote to memory of 3700 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 87 PID 3468 wrote to memory of 4672 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 91 PID 3468 wrote to memory of 4672 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 91 PID 3468 wrote to memory of 4672 3468 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 91 PID 3700 wrote to memory of 3248 3700 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 92 PID 3700 wrote to memory of 3248 3700 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 92 PID 3700 wrote to memory of 3248 3700 b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe 92
Processes
-
C:\Users\Admin\AppData\Local\Temp\b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe"C:\Users\Admin\AppData\Local\Temp\b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe"1⤵
- Drops file in Drivers directory
- Sets service image path in registry
- Loads dropped DLL
- Adds Run key to start application
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3468 -
C:\Users\Admin\AppData\Local\Temp\b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe"C:\Users\Admin\AppData\Local\Temp\b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe"2⤵
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3700 -
C:\Users\Admin\AppData\Local\Temp\b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe"C:\Users\Admin\AppData\Local\Temp\b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe"3⤵PID:3248
-
-
-
C:\Users\Admin\AppData\Local\Temp\b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe"C:\Users\Admin\AppData\Local\Temp\b69127a80b8fa164ba4dfaf8edc2cbe7e4b09045e71627a474ac55a611cc5e1a.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
PID:4672
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\cftmon.exe
- Size 138KB
- SHA256 348989f641250b3176c080df2bc177b470f90b30679cab96e2b2e61619b43495
- MD5 93e835f53adeabcf3c5ecd0099a64015
- SHA1 ceb7824b1464c9406d8772562c38cb185884aab6
- SHA512 22f3353e02ecbd258a6cd4e436acbf87238dc7c63232bc66c32e42a331c1a23e7072b67cdaab53c07bdd7caa108bc26ad568387c8fc5b4a037cd457c7ae20cfb
- SSDEEP 3072:QSM+4qCYLw4QhsuU23jUVeVyYwlK637C9mwDrOeqQtyv:QSM9qCYL2rU2YCwU6OZu
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Windows\SysWOW64\ftpdll.dll
- Size 5KB
- SHA256 1ff1089cd45af1f67601e86c77ae8c24cd632f44c7ef97b65676bbc5ed7212f5
- MD5 11bf9bea80add82f873e4c31b9d28d2e
- SHA1 1c2e0732fbbc97dcee9150380bfb63d2bf014e88
- SHA512 32ff380653d4b27cfc5baafa754b7edc22a59d412ab37635866c36f80bcad29404c9f8a395dcb7da900ecc72446dbe2491a54699afa711033afcbf087981be2d
- SSDEEP 96:/JvNr1niSLe4pa+2+vCfaC7IqeR0t9S8k7v9iUe/:/5XntL/Ab+vCyxR0tQ8k7vY
- MD5 SHA1 SHA512 SSDEEP