Analysis
-
max time kernel
11s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 03:56
Static task
static1
Behavioral task
behavioral1
Sample
e84e4da0f16e40521247870311efd7ac.exe
Resource
win7-20240508-en
Behavioral task
behavioral2
Sample
e84e4da0f16e40521247870311efd7ac.exe
Resource
win10v2004-20240611-en
General
-
Target
e84e4da0f16e40521247870311efd7ac.exe
-
Size
556KB
-
MD5
e84e4da0f16e40521247870311efd7ac
-
SHA1
30683171aae1e7dd7288e3b1ad7ef1fbde632365
-
SHA256
fa4da01ef3e3d6eca87a36ba135e9b2084461a68e975895bc57050f6ab472def
-
SHA512
0b763636a40bf7bb09521859db1b78ea205bc17a6fe685851a1dce8d3f64a101267c56f706742a7c2dab0e61709924126793853ffa3f84bb706145e6817dbb2b
-
SSDEEP
12288:VRSNhZBlfA8/C8sSoC+PZE9O2bJIC0fDNNr:VsfA8K8J+O93l0fZF
Malware Config
Signatures
-
Sets service image path in registry 2 TTPs 1 IoCs
Processes:
3tZns.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\NalDrv\ImagePath = "\\??\\C:\\Users\\Admin\\AppData\\Local\\Temp\\NalDrv.sys" 3tZns.exe -
Executes dropped EXE 1 IoCs
Processes:
3tZns.exepid process 2592 3tZns.exe -
Loads dropped DLL 1 IoCs
Processes:
e84e4da0f16e40521247870311efd7ac.exepid process 1852 e84e4da0f16e40521247870311efd7ac.exe -
Drops file in Windows directory 2 IoCs
Processes:
e84e4da0f16e40521247870311efd7ac.exedescription ioc process File created C:\Windows\SoftwareDistribution\Download\3tZns.sys e84e4da0f16e40521247870311efd7ac.exe File created C:\Windows\SoftwareDistribution\Download\3tZns.exe e84e4da0f16e40521247870311efd7ac.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e84e4da0f16e40521247870311efd7ac.exepid process 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe 1852 e84e4da0f16e40521247870311efd7ac.exe -
Suspicious behavior: LoadsDriver 1 IoCs
Processes:
3tZns.exepid process 2592 3tZns.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
3tZns.exedescription pid process Token: SeSystemEnvironmentPrivilege 2592 3tZns.exe Token: SeDebugPrivilege 2592 3tZns.exe Token: SeLoadDriverPrivilege 2592 3tZns.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
e84e4da0f16e40521247870311efd7ac.exedescription pid process target process PID 1852 wrote to memory of 2592 1852 e84e4da0f16e40521247870311efd7ac.exe 3tZns.exe PID 1852 wrote to memory of 2592 1852 e84e4da0f16e40521247870311efd7ac.exe 3tZns.exe PID 1852 wrote to memory of 2592 1852 e84e4da0f16e40521247870311efd7ac.exe 3tZns.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e84e4da0f16e40521247870311efd7ac.exe"C:\Users\Admin\AppData\Local\Temp\e84e4da0f16e40521247870311efd7ac.exe"1⤵
- Loads dropped DLL
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SoftwareDistribution\Download\3tZns.exe"C:\Windows\SoftwareDistribution\Download\3tZns.exe" -map C:\Windows\SoftwareDistribution\Download\3tZns.sys2⤵
- Sets service image path in registry
- Executes dropped EXE
- Suspicious behavior: LoadsDriver
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
\Windows\SoftwareDistribution\Download\3tZns.exeFilesize
260KB
MD5083c6c05ac5875d0b6e997e894ca07bc
SHA169d0116998e8a70db5852fccb86d45975ce88a9a
SHA25603aefd40698cafbd48138784f362fb9a36f726fb50f262ca40695729f7b553ca
SHA512fb0b9994f9ddadd825476ed19a8299ef90536dae58b4f3087145ca4033a63d4ae0da944ac8bf4e71324e1b63af755ab1d82019e55de6377b00c9812ed57f3fdf