Analysis
-
max time kernel
121s -
max time network
126s -
platform
windows7_x64 -
resource
win7-20241010-en -
resource tags
arch:x64arch:x86image:win7-20241010-enlocale:en-usos:windows7-x64system -
submitted
23-11-2024 07:53
Behavioral task
behavioral1
Sample
0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe
Resource
win7-20241010-en
windows7-x64
17 signatures
150 seconds
General
-
Target
0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe
-
Size
13.4MB
-
MD5
cf941555a37a8e746db60544ca4b61a1
-
SHA1
cf097b6731d0544772bd5a4595b54c11b631d3ea
-
SHA256
0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684
-
SHA512
4ededa1eeb05a96f0c8621049426a419cc3815d0ab22aa1994c257bb922ac44cf16c9ac743af6e0ba2fd0f647e701aa0e7b0605840a346dd280ed29deef8a851
-
SSDEEP
393216:8u1LuYwYuYgu1LuYwYuYIu1LuYwYuYgu1LuYwYuYb:/
Malware Config
Signatures
-
Blackmoon family
-
Detect Blackmoon payload 4 IoCs
Processes:
resource yara_rule behavioral1/memory/2236-0-0x0000000000400000-0x00000000004AB000-memory.dmp family_blackmoon behavioral1/memory/2236-4-0x0000000000400000-0x00000000004AB000-memory.dmp family_blackmoon behavioral1/files/0x0007000000016cab-5.dat family_blackmoon behavioral1/memory/2200-9-0x0000000000400000-0x00000000004AB000-memory.dmp family_blackmoon -
Executes dropped EXE 2 IoCs
Processes:
fxcizjs.exefxcizjs.exepid Process 2200 fxcizjs.exe 2748 fxcizjs.exe -
Loads dropped DLL 4 IoCs
Processes:
cmd.exeWerFault.exepid Process 2188 cmd.exe 2188 cmd.exe 2628 WerFault.exe 2628 WerFault.exe -
Drops file in System32 directory 1 IoCs
Processes:
fxcizjs.exedescription ioc Process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat fxcizjs.exe -
Drops file in Windows directory 2 IoCs
Processes:
0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exedescription ioc Process File created \??\c:\windows\fonts\fchbxgeq\fxcizjs.exe 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe File opened for modification \??\c:\windows\fonts\fchbxgeq\fxcizjs.exe 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target Process procid_target 2628 2748 WerFault.exe 35 -
System Location Discovery: System Language Discovery 1 TTPs 4 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
Processes:
0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.execmd.exePING.EXEfxcizjs.exedescription ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language cmd.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language PING.EXE Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language fxcizjs.exe -
System Network Configuration Discovery: Internet Connection Discovery 1 TTPs 2 IoCs
Adversaries may check for Internet connectivity on compromised systems.
Processes:
cmd.exePING.EXEpid Process 2188 cmd.exe 2536 PING.EXE -
Modifies data under HKEY_USERS 24 IoCs
Processes:
fxcizjs.exedescription ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 fxcizjs.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a7f0090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 fxcizjs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{26AB04F6-76D5-4F31-BB5A-206374F87812}\52-24-85-1a-77-7a fxcizjs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-24-85-1a-77-7a\WpadDecisionReason = "1" fxcizjs.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings fxcizjs.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 fxcizjs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings fxcizjs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" fxcizjs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" fxcizjs.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{26AB04F6-76D5-4F31-BB5A-206374F87812}\WpadNetworkName = "Network 3" fxcizjs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-24-85-1a-77-7a fxcizjs.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-24-85-1a-77-7a\WpadDecisionTime = 6042e0db7c3ddb01 fxcizjs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\52-24-85-1a-77-7a\WpadDecision = "0" fxcizjs.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" fxcizjs.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" fxcizjs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{26AB04F6-76D5-4F31-BB5A-206374F87812} fxcizjs.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{26AB04F6-76D5-4F31-BB5A-206374F87812}\WpadDecisionTime = 6042e0db7c3ddb01 fxcizjs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections fxcizjs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ fxcizjs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" fxcizjs.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix fxcizjs.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad fxcizjs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{26AB04F6-76D5-4F31-BB5A-206374F87812}\WpadDecisionReason = "1" fxcizjs.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{26AB04F6-76D5-4F31-BB5A-206374F87812}\WpadDecision = "0" fxcizjs.exe -
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 15 IoCs
Processes:
0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exefxcizjs.exefxcizjs.exepid Process 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe 2200 fxcizjs.exe 2200 fxcizjs.exe 2200 fxcizjs.exe 2200 fxcizjs.exe 2200 fxcizjs.exe 2748 fxcizjs.exe 2748 fxcizjs.exe 2748 fxcizjs.exe 2748 fxcizjs.exe 2748 fxcizjs.exe -
Suspicious behavior: RenamesItself 1 IoCs
Processes:
0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exepid Process 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exefxcizjs.exefxcizjs.exedescription pid Process Token: SeDebugPrivilege 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe Token: SeDebugPrivilege 2200 fxcizjs.exe Token: SeDebugPrivilege 2748 fxcizjs.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
Processes:
0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exefxcizjs.exefxcizjs.exepid Process 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe 2200 fxcizjs.exe 2748 fxcizjs.exe -
Suspicious use of WriteProcessMemory 16 IoCs
Processes:
0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.execmd.exefxcizjs.exedescription pid Process procid_target PID 2236 wrote to memory of 2188 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe 31 PID 2236 wrote to memory of 2188 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe 31 PID 2236 wrote to memory of 2188 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe 31 PID 2236 wrote to memory of 2188 2236 0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe 31 PID 2188 wrote to memory of 2536 2188 cmd.exe 33 PID 2188 wrote to memory of 2536 2188 cmd.exe 33 PID 2188 wrote to memory of 2536 2188 cmd.exe 33 PID 2188 wrote to memory of 2536 2188 cmd.exe 33 PID 2188 wrote to memory of 2200 2188 cmd.exe 34 PID 2188 wrote to memory of 2200 2188 cmd.exe 34 PID 2188 wrote to memory of 2200 2188 cmd.exe 34 PID 2188 wrote to memory of 2200 2188 cmd.exe 34 PID 2748 wrote to memory of 2628 2748 fxcizjs.exe 36 PID 2748 wrote to memory of 2628 2748 fxcizjs.exe 36 PID 2748 wrote to memory of 2628 2748 fxcizjs.exe 36 PID 2748 wrote to memory of 2628 2748 fxcizjs.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe"C:\Users\Admin\AppData\Local\Temp\0162b9646481939bfadca3f7c88175a1fa3a22cf13d34b04905ff350c4310684.exe"1⤵
- Drops file in Windows directory
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2236 -
C:\Windows\SysWOW64\cmd.execmd /c ping 127.0.0.1 -n 5 & Start c:\windows\fonts\fchbxgeq\fxcizjs.exe2⤵
- Loads dropped DLL
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Suspicious use of WriteProcessMemory
PID:2188 -
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 53⤵
- System Location Discovery: System Language Discovery
- System Network Configuration Discovery: Internet Connection Discovery
- Runs ping.exe
PID:2536
-
-
\??\c:\windows\fonts\fchbxgeq\fxcizjs.exec:\windows\fonts\fchbxgeq\fxcizjs.exe3⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:2200
-
-
-
\??\c:\windows\fonts\fchbxgeq\fxcizjs.exec:\windows\fonts\fchbxgeq\fxcizjs.exe1⤵
- Executes dropped EXE
- Drops file in System32 directory
- System Location Discovery: System Language Discovery
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2748 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2748 -s 6682⤵
- Loads dropped DLL
- Program crash
PID:2628
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
13.4MB
MD5292075529b652920a0606d4d7888e56c
SHA13b6463dbdf0842b1fb592e312cd96ffa6a95b441
SHA256e22ae139d4f43dbd465c4e22bb5dbdc5a6f79fc99457fef3eefc6bbb506ad925
SHA5127c65dde2451c4c46e352c93899bf6fae373a3f2bd6c960c8c495cfaadb76d864833ed767d65ea443089779f3a1d64535340b4c6fc4c4e387247b77e9ee120104