Analysis
-
max time kernel
120s -
max time network
19s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
22-11-2024 14:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe
Resource
win7-20241010-en
windows7-x64
6 signatures
120 seconds
Behavioral task
behavioral2
Sample
1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
17 signatures
120 seconds
General
-
Target
1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe
-
Size
453KB
-
MD5
25a1ff912b26dcd19cbd5667934e68bb
-
SHA1
d76a1e23bfc2594f7714ed109e6e2a5cf4b17908
-
SHA256
1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e
-
SHA512
b17b1d4ea1a7afb6954ba7afb8f438f1c37f59792f584b7904abb4a704d1c0a05f2a179997d83a637f344b64efc7eef88b3dbbb781e836dfc632eeb3363f289a
-
SSDEEP
12288:imKmKCT6CTQNbPQMp3UoyuQTA7rQmDjrhf:5lT7i1p3rrE2jp
Score
10/10
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exedescription pid Process procid_target PID 1656 created 424 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 5 -
Indicator Removal: Clear Windows Event Logs 1 TTPs 1 IoCs
Clear Windows Event Logs to hide the activity of an intrusion.
Processes:
svchost.exedescription ioc Process File opened for modification C:\Windows\System32\Winevt\Logs\Microsoft-Windows-CodeIntegrity%4Operational.evtx svchost.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exedescription pid Process procid_target PID 1656 set thread context of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exedllhost.exepid Process 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe 2148 dllhost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exedllhost.exesvchost.exedescription pid Process Token: SeDebugPrivilege 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe Token: SeDebugPrivilege 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe Token: SeDebugPrivilege 2148 dllhost.exe Token: SeAuditPrivilege 832 svchost.exe Token: SeAssignPrimaryTokenPrivilege 832 svchost.exe Token: SeIncreaseQuotaPrivilege 832 svchost.exe Token: SeSecurityPrivilege 832 svchost.exe Token: SeTakeOwnershipPrivilege 832 svchost.exe Token: SeLoadDriverPrivilege 832 svchost.exe Token: SeSystemtimePrivilege 832 svchost.exe Token: SeBackupPrivilege 832 svchost.exe Token: SeRestorePrivilege 832 svchost.exe Token: SeShutdownPrivilege 832 svchost.exe Token: SeSystemEnvironmentPrivilege 832 svchost.exe Token: SeUndockPrivilege 832 svchost.exe Token: SeManageVolumePrivilege 832 svchost.exe Token: SeAssignPrimaryTokenPrivilege 832 svchost.exe Token: SeIncreaseQuotaPrivilege 832 svchost.exe Token: SeSecurityPrivilege 832 svchost.exe Token: SeTakeOwnershipPrivilege 832 svchost.exe Token: SeLoadDriverPrivilege 832 svchost.exe Token: SeSystemtimePrivilege 832 svchost.exe Token: SeBackupPrivilege 832 svchost.exe Token: SeRestorePrivilege 832 svchost.exe Token: SeShutdownPrivilege 832 svchost.exe Token: SeSystemEnvironmentPrivilege 832 svchost.exe Token: SeUndockPrivilege 832 svchost.exe Token: SeManageVolumePrivilege 832 svchost.exe Token: SeAssignPrimaryTokenPrivilege 832 svchost.exe Token: SeIncreaseQuotaPrivilege 832 svchost.exe Token: SeSecurityPrivilege 832 svchost.exe Token: SeTakeOwnershipPrivilege 832 svchost.exe Token: SeLoadDriverPrivilege 832 svchost.exe Token: SeSystemtimePrivilege 832 svchost.exe Token: SeBackupPrivilege 832 svchost.exe Token: SeRestorePrivilege 832 svchost.exe Token: SeShutdownPrivilege 832 svchost.exe Token: SeSystemEnvironmentPrivilege 832 svchost.exe Token: SeUndockPrivilege 832 svchost.exe Token: SeManageVolumePrivilege 832 svchost.exe Token: SeAssignPrimaryTokenPrivilege 832 svchost.exe Token: SeIncreaseQuotaPrivilege 832 svchost.exe Token: SeSecurityPrivilege 832 svchost.exe Token: SeTakeOwnershipPrivilege 832 svchost.exe Token: SeLoadDriverPrivilege 832 svchost.exe Token: SeSystemtimePrivilege 832 svchost.exe Token: SeBackupPrivilege 832 svchost.exe Token: SeRestorePrivilege 832 svchost.exe Token: SeShutdownPrivilege 832 svchost.exe Token: SeSystemEnvironmentPrivilege 832 svchost.exe Token: SeUndockPrivilege 832 svchost.exe Token: SeManageVolumePrivilege 832 svchost.exe Token: SeAssignPrimaryTokenPrivilege 832 svchost.exe Token: SeIncreaseQuotaPrivilege 832 svchost.exe Token: SeSecurityPrivilege 832 svchost.exe Token: SeTakeOwnershipPrivilege 832 svchost.exe Token: SeLoadDriverPrivilege 832 svchost.exe Token: SeSystemtimePrivilege 832 svchost.exe Token: SeBackupPrivilege 832 svchost.exe Token: SeRestorePrivilege 832 svchost.exe Token: SeShutdownPrivilege 832 svchost.exe Token: SeSystemEnvironmentPrivilege 832 svchost.exe Token: SeUndockPrivilege 832 svchost.exe Token: SeManageVolumePrivilege 832 svchost.exe -
Suspicious use of WriteProcessMemory 34 IoCs
Processes:
1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exedllhost.exedescription pid Process procid_target PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 1656 wrote to memory of 2148 1656 1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe 29 PID 2148 wrote to memory of 424 2148 dllhost.exe 5 PID 2148 wrote to memory of 468 2148 dllhost.exe 6 PID 2148 wrote to memory of 484 2148 dllhost.exe 7 PID 2148 wrote to memory of 492 2148 dllhost.exe 8 PID 2148 wrote to memory of 604 2148 dllhost.exe 9 PID 2148 wrote to memory of 680 2148 dllhost.exe 10 PID 2148 wrote to memory of 740 2148 dllhost.exe 11 PID 2148 wrote to memory of 808 2148 dllhost.exe 12 PID 2148 wrote to memory of 832 2148 dllhost.exe 13 PID 2148 wrote to memory of 988 2148 dllhost.exe 14 PID 2148 wrote to memory of 296 2148 dllhost.exe 15 PID 2148 wrote to memory of 664 2148 dllhost.exe 16 PID 2148 wrote to memory of 1040 2148 dllhost.exe 17 PID 2148 wrote to memory of 1128 2148 dllhost.exe 18 PID 2148 wrote to memory of 1180 2148 dllhost.exe 19 PID 2148 wrote to memory of 1244 2148 dllhost.exe 20 PID 2148 wrote to memory of 1556 2148 dllhost.exe 22 PID 2148 wrote to memory of 1788 2148 dllhost.exe 23 PID 2148 wrote to memory of 1880 2148 dllhost.exe 24 PID 2148 wrote to memory of 1940 2148 dllhost.exe 25 PID 2148 wrote to memory of 1920 2148 dllhost.exe 26 PID 2148 wrote to memory of 1656 2148 dllhost.exe 28
Processes
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵PID:424
-
C:\Windows\System32\dllhost.exeC:\Windows\System32\dllhost.exe /Processid:{5bf437a3-c02b-498d-9cd3-0a012cd190b5}2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2148
-
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵PID:468
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k DcomLaunch2⤵PID:604
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}3⤵PID:1556
-
-
C:\Windows\system32\wbem\wmiprvse.exeC:\Windows\system32\wbem\wmiprvse.exe3⤵PID:1880
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k RPCSS2⤵PID:680
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted2⤵
- Indicator Removal: Clear Windows Event Logs
PID:740
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted2⤵PID:808
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"3⤵PID:1180
-
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs2⤵
- Suspicious use of AdjustPrivilegeToken
PID:832
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService2⤵PID:988
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k NetworkService2⤵PID:296
-
-
C:\Windows\System32\spoolsv.exeC:\Windows\System32\spoolsv.exe2⤵PID:664
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceNoNetwork2⤵PID:1040
-
-
C:\Windows\system32\taskhost.exe"taskhost.exe"2⤵PID:1128
-
-
C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE"2⤵PID:1788
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation2⤵PID:1940
-
-
C:\Windows\system32\sppsvc.exeC:\Windows\system32\sppsvc.exe2⤵PID:1920
-
-
C:\Windows\system32\lsass.exeC:\Windows\system32\lsass.exe1⤵PID:484
-
C:\Windows\system32\lsm.exeC:\Windows\system32\lsm.exe1⤵PID:492
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe"C:\Users\Admin\AppData\Local\Temp\1b6501b51ea4e47cf26b377816a7e3bd67d8dad29d7b3d0654f79be6f953406e.exe"2⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1656
-