Analysis
- max time kernel
152s - max time network
50s - platform
windows7_x64 - resource
win7v200430 - submitted
24/06/2020, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe
- Size 266KB
- Sample200624-528cm4m3b6
- SHA256 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce
- MD5 0e1cf6be3c57ee8a2a21d5211e419828
- SHA1 b99e6143c3ddc46b9d0baa1752221872637f792b
- SHA512 a6cf1cbdf4020e9fe9a4f7c226cc3f15f82b69af54386a606348dc601529780750920095c103aef7b9a4f8d4fabf59bd12618bf01ad1fe124976e2a0feeb5f2e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1541a27be939231a9f9b9cc0dc7d70af.exe winlogon.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1541a27be939231a9f9b9cc0dc7d70af.exe winlogon.exe - Loads dropped DLL 2 IoCs
pid Process 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe - Executes dropped EXE 3 IoCs
pid Process 1088 Server.exe 1400 winlogon.exe 904 Server.exe - Adds Run entry to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe Set value (str) \REGISTRY\USER\S-1-5-21-910373003-3952921535-3480519689-1000\Software\Microsoft\Windows\CurrentVersion\Run\1541a27be939231a9f9b9cc0dc7d70af = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winlogon.exe\" .." winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1541a27be939231a9f9b9cc0dc7d70af = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winlogon.exe\" .." winlogon.exe - Modifies Windows Firewall 1 TTPs
- Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 316 wrote to memory of 1088 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 24 PID 316 wrote to memory of 1088 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 24 PID 316 wrote to memory of 1088 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 24 PID 316 wrote to memory of 1088 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 24 PID 316 wrote to memory of 1088 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 24 PID 316 wrote to memory of 1088 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 24 PID 316 wrote to memory of 1088 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 24 PID 1088 wrote to memory of 1400 1088 Server.exe 25 PID 1088 wrote to memory of 1400 1088 Server.exe 25 PID 1088 wrote to memory of 1400 1088 Server.exe 25 PID 1088 wrote to memory of 1400 1088 Server.exe 25 PID 1088 wrote to memory of 1400 1088 Server.exe 25 PID 316 wrote to memory of 904 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 26 PID 316 wrote to memory of 904 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 26 PID 316 wrote to memory of 904 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 26 PID 316 wrote to memory of 904 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 26 PID 316 wrote to memory of 904 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 26 PID 316 wrote to memory of 904 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 26 PID 316 wrote to memory of 904 316 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 26 PID 1400 wrote to memory of 1040 1400 winlogon.exe 27 PID 1400 wrote to memory of 1040 1400 winlogon.exe 27 PID 1400 wrote to memory of 1040 1400 winlogon.exe 27 PID 1400 wrote to memory of 1040 1400 winlogon.exe 27 PID 1400 wrote to memory of 1040 1400 winlogon.exe 27 - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe Token: 33 1400 winlogon.exe Token: SeIncBasePriorityPrivilege 1400 winlogon.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe"C:\Users\Admin\AppData\Local\Temp\e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe"1⤵
- Loads dropped DLL
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:316 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exe2⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Users\Admin\AppData\Local\Temp\winlogon.exe"C:\Users\Admin\AppData\Local\Temp\winlogon.exe"3⤵
- Drops startup file
- Executes dropped EXE
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:1400 -
C:\Windows\system32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\winlogon.exe" "winlogon.exe" ENABLE4⤵
- Modifies service
PID:1040
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exe2⤵
- Executes dropped EXE
PID:904
-