Analysis
- max time kernel
150s - max time network
134s - platform
windows10_x64 - resource
win10 - submitted
29/06/2020, 07:53
Static task
static1
Behavioral task
behavioral1
Sample
9ae3d2baf3c382b46b56e3e50547bd83bd1d6cc85f82aadaf2281a1b404e5fa0.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9ae3d2baf3c382b46b56e3e50547bd83bd1d6cc85f82aadaf2281a1b404e5fa0.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 9ae3d2baf3c382b46b56e3e50547bd83bd1d6cc85f82aadaf2281a1b404e5fa0.exe
- Size 43KB
- Sample200629-7lwlq2dhtn
- SHA256 9ae3d2baf3c382b46b56e3e50547bd83bd1d6cc85f82aadaf2281a1b404e5fa0
- MD5 d4a0265525010210f0fc06a761194f8a
- SHA1 61ecc9108d45d12614bdbc19386da0152e9c751f
- SHA512 7372e00572799ac063def7e482b92f454ef085e9e431e892052485ccb9ea016e9e2cf36ad57df7e9c35d49e82bb621b49332f87719923cb858003da80adfca37
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3788 wrote to memory of 3836 3788 9ae3d2baf3c382b46b56e3e50547bd83bd1d6cc85f82aadaf2281a1b404e5fa0.exe 67 PID 3788 wrote to memory of 3836 3788 9ae3d2baf3c382b46b56e3e50547bd83bd1d6cc85f82aadaf2281a1b404e5fa0.exe 67 PID 3788 wrote to memory of 3836 3788 9ae3d2baf3c382b46b56e3e50547bd83bd1d6cc85f82aadaf2281a1b404e5fa0.exe 67 - Executes dropped EXE 1 IoCs
pid Process 3836 WindowsSystem.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe Token: 33 3836 WindowsSystem.exe Token: SeIncBasePriorityPrivilege 3836 WindowsSystem.exe - Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsSystem.exe\" .." WindowsSystem.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "\"C:\\Users\\Admin\\AppData\\Roaming\\WindowsSystem.exe\" .." WindowsSystem.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe WindowsSystem.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Java update.exe WindowsSystem.exe - Suspicious behavior: GetForegroundWindowSpam 2 IoCs
pid Process 3788 9ae3d2baf3c382b46b56e3e50547bd83bd1d6cc85f82aadaf2281a1b404e5fa0.exe 3836 WindowsSystem.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9ae3d2baf3c382b46b56e3e50547bd83bd1d6cc85f82aadaf2281a1b404e5fa0.exe"C:\Users\Admin\AppData\Local\Temp\9ae3d2baf3c382b46b56e3e50547bd83bd1d6cc85f82aadaf2281a1b404e5fa0.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: GetForegroundWindowSpam
PID:3788 -
C:\Users\Admin\AppData\Roaming\WindowsSystem.exe"C:\Users\Admin\AppData\Roaming\WindowsSystem.exe"2⤵
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Drops startup file
- Suspicious behavior: GetForegroundWindowSpam
PID:3836
-