Analysis
- max time kernel
149s - max time network
140s - platform
windows10_x64 - resource
win10 - submitted
24/06/2020, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe
- Size 470KB
- Sample200624-a41db3pv9e
- SHA256 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9
- MD5 035c016c481c1fa0dcadcd027b3f863d
- SHA1 196b9aa34e52bf83ab1aae990e3b7a77ddb652d8
- SHA512 3a508d155163cad50748a6eeddadf9a7fd51d6cb0c62892b9a6437fd3ade52c477ec0225c9be10c836ea4f5ca1d44b2a4c8456395de210b59ac0504969ff8b3b
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Modifies registry class 6 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\CID\{74002B00-6500-3100-6B00-720030005500}\1 = "HNWkfzEhFNvUjFT2XyDgeF1jw3VV5ylsftUcJIj1uowtMko8HmVYo8B8zQflfqCEgXPJ5bUO9ZUBQm/j3ebiQB5oVKkFVuk7zp5wL+/3Q+g7hoYNuI13des8Fl3AwME7H4Ty3bXGFGak6R3o5uDjqRfG6DjAbddlRbmTrveRU8k=" System32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\CID\{74002B00-6500-3100-6B00-720030005500}\1 = "RxsS++PvNLqXFLHfRsef3dRQgr/pK5yx3gv8+pEHqvTfhNo4/PSSX8VKe8FMZ15NeO82hF1LkK19zNZGogrWxmbxQDt6tnFMkR34g76KKU87s9SyDK9IXuYLmuT4Mip8fd/tjYIe3iXW1xMH17Bxn70a8ZUKeC+6EuoxpPFMmk0=" System32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\CID\{74002B00-6500-3100-6B00-720030005500}\1 = "Wsv6EUT6Bc8LbDv6T5sRU58F1evCDSaNe93wxCHdWkiM0Pa55/hY1Wz0P+VZL0n6mb1AQL6IUKjwgoxYufVuHCL8OZJ5h+0z3PlEAdA84IShroreqRVDxNZvz4s4gzNbh1GScelq0/EXxno+IwNJM1O+3A5tME3872eYa2RjOqI=" System32.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\CID\{74002B00-6500-3100-6B00-720030005500} 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe Key created \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\CID 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000_Classes\CID\{74002B00-6500-3100-6B00-720030005500}\1 = "ozubK22UR78QCzf9aCDjNQcJYpb7VmWakHLcM4Bi7f4jmv4gXYxPQVX8MmJQ9mi9E2CnYJokAtCMEVdALA2WgSugsP++8qAxmSiLEF0sGve1OPTvvBGQlPj2OR912xSO75qfNgJbwjaz26pv+kdepZJJtUMlzyGAy0MWv3z28AE=" 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe - NTFS ADS 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Local\Temp:{47004B00-7200-3400-5800-710048003100} 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe File opened for modification C:\Users\Admin\AppData\Local\Temp:{47004B00-7200-3400-5800-710048003100} System32.exe - Suspicious behavior: EnumeratesProcesses 49 IoCs
pid Process 2896 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe 2896 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe 3828 System32.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 2896 wrote to memory of 3828 2896 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe 68 PID 2896 wrote to memory of 3828 2896 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe 68 PID 2896 wrote to memory of 3828 2896 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe 68 PID 3828 wrote to memory of 3756 3828 System32.exe 69 PID 3828 wrote to memory of 3756 3828 System32.exe 69 PID 3828 wrote to memory of 3756 3828 System32.exe 69 - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2320633bbd5b9c41d628d6d2b760a34d.exe System32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2320633bbd5b9c41d628d6d2b760a34d.exe System32.exe - Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\2320633bbd5b9c41d628d6d2b760a34d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2320633bbd5b9c41d628d6d2b760a34d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2896 1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe Token: SeDebugPrivilege 3828 System32.exe - Executes dropped EXE 1 IoCs
pid Process 3828 System32.exe - Modifies Windows Firewall 1 TTPs
Processes
-
C:\Users\Admin\AppData\Local\Temp\1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe"C:\Users\Admin\AppData\Local\Temp\1acdf1fa101a7f3d7c59bdc7494a67879a0b1b0410122072f73ecf3cc8eff5e9.exe"1⤵
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
PID:2896 -
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"2⤵
- Modifies registry class
- NTFS ADS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Drops startup file
- Adds Run entry to start application
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
PID:3828 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System32.exe" "System32.exe" ENABLE3⤵PID:3756
-
-