Analysis
- max time kernel
150s - max time network
149s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 15:06
Static task
static1
Behavioral task
behavioral1
Sample
e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe
- Size 266KB
- Sample200624-528cm4m3b6
- SHA256 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce
- MD5 0e1cf6be3c57ee8a2a21d5211e419828
- SHA1 b99e6143c3ddc46b9d0baa1752221872637f792b
- SHA512 a6cf1cbdf4020e9fe9a4f7c226cc3f15f82b69af54386a606348dc601529780750920095c103aef7b9a4f8d4fabf59bd12618bf01ad1fe124976e2a0feeb5f2e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1541a27be939231a9f9b9cc0dc7d70af.exe winlogon.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1541a27be939231a9f9b9cc0dc7d70af.exe winlogon.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1508 wrote to memory of 1664 1508 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 68 PID 1508 wrote to memory of 1664 1508 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 68 PID 1664 wrote to memory of 2204 1664 Server.exe 70 PID 1664 wrote to memory of 2204 1664 Server.exe 70 PID 1508 wrote to memory of 4064 1508 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 71 PID 1508 wrote to memory of 4064 1508 e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe 71 PID 2204 wrote to memory of 3952 2204 winlogon.exe 75 PID 2204 wrote to memory of 3952 2204 winlogon.exe 75 - Executes dropped EXE 3 IoCs
pid Process 1664 Server.exe 2204 winlogon.exe 4064 Server.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe Token: 33 2204 winlogon.exe Token: SeIncBasePriorityPrivilege 2204 winlogon.exe - Adds Run entry to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\1541a27be939231a9f9b9cc0dc7d70af = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winlogon.exe\" .." winlogon.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1541a27be939231a9f9b9cc0dc7d70af = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\winlogon.exe\" .." winlogon.exe Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe"C:\Users\Admin\AppData\Local\Temp\e7a8f968f1c68de29d5cbadaef5ae9b10cc8b8098669feed67a5a570814182ce.exe"1⤵
- Suspicious use of WriteProcessMemory
- Adds Run entry to start application
PID:1508 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exe2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1664 -
C:\Users\Admin\AppData\Local\Temp\winlogon.exe"C:\Users\Admin\AppData\Local\Temp\winlogon.exe"3⤵
- Drops startup file
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
PID:2204 -
C:\Windows\SYSTEM32\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\winlogon.exe" "winlogon.exe" ENABLE4⤵PID:3952
-
-
-
-
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\Server.exe2⤵
- Executes dropped EXE
PID:4064
-