9f800400f5ed4b80a6d032a437e3b7fc8fa53978854726fdfc0f2737c1237596

Analysis

max time kernel
92s
max time network
94s
platform
windows11-21h2_x64
resource
win11-20241007-en
resource tags

arch:x64arch:x86image:win11-20241007-enlocale:en-usos:windows11-21h2-x64system
submitted
29-12-2024 19:37

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

123[1].exe
Size

493KB
MD5

8e92c683e644b7e88184427d1b8625bb
SHA1

8b57d61299f7eaa32df979f54483ff72b47ba8f6
SHA256

9f800400f5ed4b80a6d032a437e3b7fc8fa53978854726fdfc0f2737c1237596
SHA512

027a5b35ef52be102fe4447be581140fc3cdbfd73d4531f1ebfab75672c84946dd9a4dd5ac144d9cf5e9b60a2890e0a975b254674d58ee24e3cbfc5282521dde
SSDEEP

12288:86dbSjl1WZ1oIL0WoxG3arMd9sG3SOH5:PmBMIIoWCN4Hsk7Z

Score

8^/10

persistence

Malware Config

Signatures

Sets service image path in registry 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1547.001

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\TaskKill\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\Иисус.sys"	123[1].exe

Uses the VBS compiler for execution 1 TTPs

Command and Scripting Interpreter
T1059

Suspicious behavior: EnumeratesProcesses 62 IoCs

pid	Process
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe
3844	123[1].exe

Suspicious behavior: LoadsDriver 1 IoCs

pid	Process
3844	123[1].exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	3844	123[1].exe
Token: SeLoadDriverPrivilege	3844	123[1].exe
Token: SeDebugPrivilege	3844	123[1].exe

Suspicious use of WriteProcessMemory 64 IoCs

description	pid	Process	procid_target
PID 3844 wrote to memory of 4836	3844	123[1].exe	78
PID 3844 wrote to memory of 4836	3844	123[1].exe	78
PID 3844 wrote to memory of 5952	3844	123[1].exe	79
PID 3844 wrote to memory of 5952	3844	123[1].exe	79
PID 3844 wrote to memory of 6032	3844	123[1].exe	80
PID 3844 wrote to memory of 6032	3844	123[1].exe	80
PID 3844 wrote to memory of 5560	3844	123[1].exe	81
PID 3844 wrote to memory of 5560	3844	123[1].exe	81
PID 3844 wrote to memory of 5696	3844	123[1].exe	82
PID 3844 wrote to memory of 5696	3844	123[1].exe	82
PID 3844 wrote to memory of 6056	3844	123[1].exe	83
PID 3844 wrote to memory of 6056	3844	123[1].exe	83
PID 3844 wrote to memory of 6096	3844	123[1].exe	84
PID 3844 wrote to memory of 6096	3844	123[1].exe	84
PID 3844 wrote to memory of 6108	3844	123[1].exe	85
PID 3844 wrote to memory of 6108	3844	123[1].exe	85
PID 3844 wrote to memory of 5940	3844	123[1].exe	86
PID 3844 wrote to memory of 5940	3844	123[1].exe	86
PID 3844 wrote to memory of 3564	3844	123[1].exe	87
PID 3844 wrote to memory of 3564	3844	123[1].exe	87
PID 3844 wrote to memory of 3564	3844	123[1].exe	87
PID 3844 wrote to memory of 3080	3844	123[1].exe	88
PID 3844 wrote to memory of 3080	3844	123[1].exe	88
PID 3844 wrote to memory of 4912	3844	123[1].exe	89
PID 3844 wrote to memory of 4912	3844	123[1].exe	89
PID 3844 wrote to memory of 5576	3844	123[1].exe	90
PID 3844 wrote to memory of 5576	3844	123[1].exe	90
PID 3844 wrote to memory of 4952	3844	123[1].exe	91
PID 3844 wrote to memory of 4952	3844	123[1].exe	91
PID 3844 wrote to memory of 5444	3844	123[1].exe	92
PID 3844 wrote to memory of 5444	3844	123[1].exe	92
PID 3844 wrote to memory of 4456	3844	123[1].exe	93
PID 3844 wrote to memory of 4456	3844	123[1].exe	93
PID 3844 wrote to memory of 5036	3844	123[1].exe	94
PID 3844 wrote to memory of 5036	3844	123[1].exe	94
PID 3844 wrote to memory of 2496	3844	123[1].exe	95
PID 3844 wrote to memory of 2496	3844	123[1].exe	95
PID 3844 wrote to memory of 4296	3844	123[1].exe	96
PID 3844 wrote to memory of 4296	3844	123[1].exe	96
PID 3844 wrote to memory of 4584	3844	123[1].exe	97
PID 3844 wrote to memory of 4584	3844	123[1].exe	97
PID 3844 wrote to memory of 3784	3844	123[1].exe	98
PID 3844 wrote to memory of 3784	3844	123[1].exe	98
PID 3844 wrote to memory of 3784	3844	123[1].exe	98
PID 3844 wrote to memory of 5052	3844	123[1].exe	99
PID 3844 wrote to memory of 5052	3844	123[1].exe	99
PID 3844 wrote to memory of 5988	3844	123[1].exe	100
PID 3844 wrote to memory of 5988	3844	123[1].exe	100
PID 3844 wrote to memory of 236	3844	123[1].exe	101
PID 3844 wrote to memory of 236	3844	123[1].exe	101
PID 3844 wrote to memory of 2788	3844	123[1].exe	102
PID 3844 wrote to memory of 2788	3844	123[1].exe	102
PID 3844 wrote to memory of 232	3844	123[1].exe	103
PID 3844 wrote to memory of 232	3844	123[1].exe	103
PID 3844 wrote to memory of 3708	3844	123[1].exe	104
PID 3844 wrote to memory of 3708	3844	123[1].exe	104
PID 3844 wrote to memory of 3444	3844	123[1].exe	105
PID 3844 wrote to memory of 3444	3844	123[1].exe	105
PID 3844 wrote to memory of 4740	3844	123[1].exe	106
PID 3844 wrote to memory of 4740	3844	123[1].exe	106
PID 3844 wrote to memory of 1224	3844	123[1].exe	107
PID 3844 wrote to memory of 1224	3844	123[1].exe	107
PID 3844 wrote to memory of 2084	3844	123[1].exe	108
PID 3844 wrote to memory of 2084	3844	123[1].exe	108

C:\Users\Admin\AppData\Local\Temp\123[1].exe
"C:\Users\Admin\AppData\Local\Temp\123[1].exe"
1⤵
- Sets service image path in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3844
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_compiler.exe"
  2⤵
  PID:4836
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInUtil.exe"
  2⤵
  PID:5952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"
  2⤵
  PID:6032
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regsql.exe"
  2⤵
  PID:5560
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\MSBuild.exe"
  2⤵
  PID:5696
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\WsatConfig.exe"
  2⤵
  PID:6056
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\dfsvc.exe"
  2⤵
  PID:6096
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngentask.exe"
  2⤵
  PID:6108
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe"
  2⤵
  PID:5940
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess32.exe"
  2⤵
  PID:3564
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AppLaunch.exe"
  2⤵
  PID:3080
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\EdmGen.exe"
  2⤵
  PID:4912
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ngen.exe"
  2⤵
  PID:5576
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\CasPol.exe"
  2⤵
  PID:4952
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\vbc.exe"
  2⤵
  PID:5444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe"
  2⤵
  PID:4456
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegAsm.exe"
  2⤵
  PID:5036
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regbrowsers.exe"
  2⤵
  PID:2496
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\RegSvcs.exe"
  2⤵
  PID:4296
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe"
  2⤵
  PID:4584
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\jsc.exe"
  2⤵
  PID:3784
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_wp.exe"
  2⤵
  PID:5052
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\DataSvcUtil.exe"
  2⤵
  PID:5988
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\Microsoft.Workflow.Compiler.exe"
  2⤵
  PID:236
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\InstallUtil.exe"
  2⤵
  PID:2788
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_regiis.exe"
  2⤵
  PID:232
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ComSvcConfig.exe"
  2⤵
  PID:3708
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe"
  2⤵
  PID:3444
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ServiceModelReg.exe"
  2⤵
  PID:4740
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\AddInProcess.exe"
  2⤵
  PID:1224
- C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
  "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe"
  2⤵
  PID:2084

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

Persistence

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Privilege Escalation

Boot or Logon Autostart Execution

T1547

Registry Run Keys / Startup Folder

T1547.001

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/3844-0-0x00007FF912A73000-0x00007FF912A75000-memory.dmp

Filesize
8KB

Download
memory/3844-1-0x00000251CE6F0000-0x00000251CE76E000-memory.dmp

Filesize
504KB

Download
memory/3844-2-0x00000251E8C10000-0x00000251E8C86000-memory.dmp

Filesize
472KB

Download
memory/3844-3-0x00000251CEBA0000-0x00000251CEC18000-memory.dmp

Filesize
480KB

Download
memory/3844-4-0x00007FF912A70000-0x00007FF913532000-memory.dmp

Filesize
10.8MB

Download
memory/3844-5-0x00000251D0500000-0x00000251D051E000-memory.dmp

Filesize
120KB

Download
memory/3844-8-0x00007FF912A70000-0x00007FF913532000-memory.dmp

Filesize
10.8MB

Download