Analysis
-
max time kernel
15s -
max time network
16s -
platform
windows7_x64 -
resource
win7-20241023-en -
resource tags
arch:x64arch:x86image:win7-20241023-enlocale:en-usos:windows7-x64system -
submitted
26-11-2024 03:26
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe
Resource
win7-20241023-en
windows7-x64
4 signatures
120 seconds
Behavioral task
behavioral2
Sample
385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
16 signatures
120 seconds
General
-
Target
385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe
-
Size
976KB
-
MD5
f6635a42087a6e45da9fa48b6eb8024e
-
SHA1
a3c069f52e3494a7e2d5a13ba6648865c1be3e49
-
SHA256
385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70
-
SHA512
079de4fe9769290b96afa2a548385764f9d962152ce0ade7ba6c3f7b960d5f1336d7a3cfc554bc7f67c6fe271c4ca0bd908cb99f8d8a0f06505edce12ae4e4f0
-
SSDEEP
3072:HaXt5hsc2+T33w68MSWjFzNaMYpa/LJ9WsXrAmbvJMRYeL:6Xt5hsc2w3w6tztfnJrAm1MRF
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1163522206-1469769407-485553996-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\29E87FCDEF193186266598\\29E87FCDEF193186266598.exe" 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe -
Suspicious use of SetThreadContext 3 IoCs
description pid Process procid_target PID 2580 set thread context of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 set thread context of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 set thread context of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 -
Suspicious use of AdjustPrivilegeToken 20 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeSecurityPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeTakeOwnershipPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeLoadDriverPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeSystemProfilePrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeSystemtimePrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeProfSingleProcessPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeIncBasePriorityPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeCreatePagefilePrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeBackupPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeRestorePrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeShutdownPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeDebugPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeSystemEnvironmentPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeRemoteShutdownPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeUndockPrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: SeManageVolumePrivilege 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: 33 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: 34 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe Token: 35 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe -
Suspicious use of WriteProcessMemory 47 IoCs
description pid Process procid_target PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2464 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 30 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2580 wrote to memory of 2468 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 31 PID 2468 wrote to memory of 2516 2468 svchost.exe 32 PID 2468 wrote to memory of 2516 2468 svchost.exe 32 PID 2468 wrote to memory of 2516 2468 svchost.exe 32 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2580 wrote to memory of 2824 2580 385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe 33 PID 2464 wrote to memory of 2548 2464 audiodg.exe 34 PID 2464 wrote to memory of 2548 2464 audiodg.exe 34 PID 2464 wrote to memory of 2548 2464 audiodg.exe 34 PID 2824 wrote to memory of 2972 2824 msiexec.exe 35 PID 2824 wrote to memory of 2972 2824 msiexec.exe 35 PID 2824 wrote to memory of 2972 2824 msiexec.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe"C:\Users\Admin\AppData\Local\Temp\385040a365614ddfe8ee14d2bccb65ef5f8a123b9189ccb89144b0c6e548ea70.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\system32\audiodg.exe"C:\Windows\system32\audiodg.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2464 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2464 -s 203⤵PID:2548
-
-
-
C:\Windows\system32\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2468 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2468 -s 203⤵PID:2516
-
-
-
C:\Windows\system32\msiexec.exe"C:\Windows\system32\msiexec.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:2824 -
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2824 -s 1843⤵PID:2972
-
-