Analysis
-
max time kernel
149s -
max time network
120s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
19/11/2024, 16:02
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe
Resource
win7-20241023-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
11 signatures
150 seconds
General
-
Target
6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe
-
Size
2.3MB
-
MD5
53a8ef614aeea6668c279fc190f3b45d
-
SHA1
51b429334ac1960d5a71d9f4878661df3b9690e0
-
SHA256
6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7
-
SHA512
81e0230dba118c53d0bb091500d7480fae95cf3d3993fa9caf0309d55698e32f258bc1f655be8d8645618a075fbe3cab5994b7517efb18e83f581418787d7804
-
SSDEEP
24576:LVvvro0j8iG1nPEUa+MGpI8Dk3N4WCPspH2VyZLmudPUytwNyZq/FWKsR8zta9UA:LVLoJ1ngDB8gdqPRyZL7myeIanc8Ra91
Score
7/10
Malware Config
Signatures
-
Deletes itself 1 IoCs
pid Process 2784 cmd.exe -
Executes dropped EXE 1 IoCs
pid Process 2728 svchost.exe -
Loads dropped DLL 3 IoCs
pid Process 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe -
Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\Fonts\WinPcap\updata\svchost.exe 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe File created C:\Windows\Fonts\WinPcap\rar.exe 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe -
System Location Discovery: System Language Discovery 1 TTPs 5 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language svchost.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
pid Process 2784 cmd.exe 2796 PING.EXE -
Kills process with taskkill 1 IoCs
pid Process 2864 taskkill.exe -
Runs ping.exe 1 TTPs 1 IoCs
pid Process 2796 PING.EXE -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe 2728 svchost.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2864 taskkill.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 2728 svchost.exe 2728 svchost.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 2504 wrote to memory of 2728 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 30 PID 2504 wrote to memory of 2728 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 30 PID 2504 wrote to memory of 2728 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 30 PID 2504 wrote to memory of 2728 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 30 PID 2504 wrote to memory of 2784 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 31 PID 2504 wrote to memory of 2784 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 31 PID 2504 wrote to memory of 2784 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 31 PID 2504 wrote to memory of 2784 2504 6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe 31 PID 2784 wrote to memory of 2864 2784 cmd.exe 33 PID 2784 wrote to memory of 2864 2784 cmd.exe 33 PID 2784 wrote to memory of 2864 2784 cmd.exe 33 PID 2784 wrote to memory of 2864 2784 cmd.exe 33 PID 2784 wrote to memory of 2796 2784 cmd.exe 35 PID 2784 wrote to memory of 2796 2784 cmd.exe 35 PID 2784 wrote to memory of 2796 2784 cmd.exe 35 PID 2784 wrote to memory of 2796 2784 cmd.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe"C:\Users\Admin\AppData\Local\Temp\6d5227c70845cf5a20eb2484233a77a6432248fbc2a089faadafa9e6d5d774a7.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2504 -
C:\Windows\Fonts\WinPcap\updata\svchost.exeC:\Windows\Fonts\WinPcap\updata\svchost.exe2⤵
- Executes dropped EXE
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:2728
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /pid 2504 &ping 127.0.0.1 -n 1 &rd /s /q C:\Users\Admin\AppData\Local\Temp2⤵
- Deletes itself
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2784 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /pid 25043⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2864
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 13⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2796
-
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
21KB
MD5297564476432cc5b7345d438d115942f
SHA1250c342289f6f75ae2e6a86503c62cd0c725d622
SHA25641913a267dbe3ca49a3cef8ea17cf1bbac9114d0fbfd1bb1486c6349f388a4c3
SHA512037ac62736da313fb346443cdb0158f2e79fe645ebcbeeb9789b87eee21e52b51bae64504da6b2027e916cccc6bbd42d23757b59b4a6c5ef6eeb9aa435f71cb5
-
Filesize
1.0MB
MD59e5cc59a17a270afd79f88c3f21e958a
SHA1274f82b645b136b6933d71ebf84a20df78e36c6a
SHA256bd209a75f783907fcc4af74a0552d661088056ded6a363fb853c4a35ea06c315
SHA512fff6219e9ae226ab5df2d3f65c9ff2cd385f35e7da796ba9dcb08f796bb3c9cbd81dc3cd0c4d82cabb3512972aa3bd7b478ec9caa49c034da5730fb2441e4c48