Analysis
-
max time kernel
118s -
max time network
131s -
platform
windows7_x64 -
resource
win7-20240508-en -
resource tags
arch:x64arch:x86image:win7-20240508-enlocale:en-usos:windows7-x64system -
submitted
01-07-2024 13:33
Behavioral task
behavioral1
Sample
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe
Resource
win7-20240508-en
General
-
Target
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe
-
Size
14.4MB
-
MD5
36c5b406543fc52d5ee8736ed82000b0
-
SHA1
c598a2683493a8c5161dba2901cf2e01de6bb56a
-
SHA256
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453
-
SHA512
7f93e1ba840d6521bbad22951c409c67db916b3362d75f5937b756434bddcf3dc910ac0354385fa3bc753710fa99a4822affa2fc1e087cdf1c9a948978574a23
-
SSDEEP
393216:0TPL5gUBKn5vtQxy6eOuhi2+k66/F8up3:0TPL5g5vtQxy6etimgup
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral1/memory/3068-39-0x00000000041A0000-0x0000000004212000-memory.dmp upx behavioral1/memory/3068-42-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-65-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-64-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-61-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-59-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-57-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-55-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-53-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-51-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-49-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-48-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-45-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-43-0x0000000010000000-0x000000001003E000-memory.dmp upx behavioral1/memory/3068-41-0x0000000010000000-0x000000001003E000-memory.dmp upx -
Processes:
resource yara_rule behavioral1/memory/3068-0-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-38-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-40-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-84-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-85-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-86-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-87-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-89-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-90-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-106-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-107-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-108-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect behavioral1/memory/3068-109-0x0000000000400000-0x0000000002230000-memory.dmp vmprotect -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Processes:
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe Key created \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe Set value (str) \REGISTRY\USER\S-1-5-21-268080393-3149932598-1824759070-1000\Software\Microsoft\Internet Explorer\Main\WindowsSearch\Version = "WS not running" 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exepid process 3068 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3068 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3068 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exedescription pid process Token: SeDebugPrivilege 3068 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe -
Suspicious use of SetWindowsHookEx 6 IoCs
Processes:
39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exepid process 3068 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3068 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3068 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3068 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3068 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe 3068 39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe"C:\Users\Admin\AppData\Local\Temp\39b229b2098d95e8fa28139f5e2517a0150b5ccc6e66543e1e79e6fbb3efe453.exe"1⤵
- Modifies Internet Explorer settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3068-0-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-30-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/3068-35-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/3068-37-0x00000000010AB000-0x00000000013C5000-memory.dmpFilesize
3.1MB
-
memory/3068-33-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/3068-38-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-31-0x0000000000290000-0x0000000000291000-memory.dmpFilesize
4KB
-
memory/3068-28-0x0000000000270000-0x0000000000271000-memory.dmpFilesize
4KB
-
memory/3068-25-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/3068-39-0x00000000041A0000-0x0000000004212000-memory.dmpFilesize
456KB
-
memory/3068-23-0x0000000000260000-0x0000000000261000-memory.dmpFilesize
4KB
-
memory/3068-20-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/3068-40-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-18-0x0000000000250000-0x0000000000251000-memory.dmpFilesize
4KB
-
memory/3068-15-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/3068-13-0x0000000000240000-0x0000000000241000-memory.dmpFilesize
4KB
-
memory/3068-10-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/3068-8-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/3068-6-0x0000000000230000-0x0000000000231000-memory.dmpFilesize
4KB
-
memory/3068-5-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/3068-3-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/3068-1-0x0000000000220000-0x0000000000221000-memory.dmpFilesize
4KB
-
memory/3068-42-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-65-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-64-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-84-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-61-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-59-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-57-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-55-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-53-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-51-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-49-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-48-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-45-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-43-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-41-0x0000000010000000-0x000000001003E000-memory.dmpFilesize
248KB
-
memory/3068-85-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-86-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-87-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-89-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-90-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-106-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-107-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-108-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB
-
memory/3068-109-0x0000000000400000-0x0000000002230000-memory.dmpFilesize
30.2MB