Analysis
- max time kernel
150s - max time network
117s - platform
windows10_x64 - resource
win10 - submitted
29/06/2020, 07:10
Static task
static1
Behavioral task
behavioral1
Sample
fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763.exe
- Size 3.2MB
- Sample200629-24ftsltf4x
- SHA256 fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763
- MD5 034a52fc02e9c56763a18719835a5320
- SHA1 dd6c67b4683663bde2d6d451ae666a597f785a40
- SHA512 677ad28212d4e83dfabbb3517b2b623c8e72b159d0c214f92d7c8467c7e8d2c9028b205c520212f370d57d35e90597c8f2369f3dd7cc3df183aa2ed850449e91
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2552 Trojan.exe - Suspicious behavior: EnumeratesProcesses 47 IoCs
pid Process 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 3852 CDS.exe 3852 CDS.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe 2552 Trojan.exe - Adds Run entry to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\wextract_cleanup0 = "rundll32.exe C:\\Windows\\system32\\advpack.dll,DelNodeRunDLL32 \"C:\\Users\\Admin\\AppData\\Local\\Temp\\IXP000.TMP\\\"" fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe - Modifies Windows Firewall 1 TTPs
- Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 976 wrote to memory of 3852 976 fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763.exe 67 PID 976 wrote to memory of 3852 976 fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763.exe 67 PID 976 wrote to memory of 3852 976 fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763.exe 67 PID 3852 wrote to memory of 3500 3852 CDS.exe 68 PID 3852 wrote to memory of 3500 3852 CDS.exe 68 PID 3852 wrote to memory of 3500 3852 CDS.exe 68 PID 3500 wrote to memory of 2552 3500 crypted.exe 70 PID 3500 wrote to memory of 2552 3500 crypted.exe 70 PID 3500 wrote to memory of 2552 3500 crypted.exe 70 PID 2552 wrote to memory of 3952 2552 Trojan.exe 71 PID 2552 wrote to memory of 3952 2552 Trojan.exe 71 PID 2552 wrote to memory of 3952 2552 Trojan.exe 71 - Executes dropped EXE 3 IoCs
pid Process 3852 CDS.exe 3500 crypted.exe 2552 Trojan.exe - Loads dropped DLL 1 IoCs
pid Process 3852 CDS.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3852 CDS.exe 3852 CDS.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763.exe"C:\Users\Admin\AppData\Local\Temp\fc0ffda44e2748b424639a1592356cc209abf6045a8d6a069f5f562ea1f31763.exe"1⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
PID:976 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exeC:\Users\Admin\AppData\Local\Temp\IXP000.TMP\CDS.exe2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of SetWindowsHookEx
PID:3852 -
C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"C:\Users\Admin\AppData\Local\Temp\IXP000.TMP\crypted.exe"3⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:3500 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"4⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:2552 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE5⤵PID:3952
-
-
-
-