Analysis
- max time kernel
150s - max time network
153s - platform
windows10_x64 - resource
win10v200430 - submitted
06/07/2020, 07:30
Static task
static1
Behavioral task
behavioral1
Sample
dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe
- Size 37KB
- Sample200706-aewdms4ghx
- SHA256 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64
- MD5 6fd60d9d7512e195457e97eb371433c4
- SHA1 ec6348485e64287431ca2f04597b1fcfe1f0523e
- SHA512 74d1f4c9c7f074044b4564de0cba2a53195f82a0b9853adf05397af1a6862f7f0cd1cd4339f2ff5ffafe6ae10d92665b11892ef12a226bf6e14cbc98b2fdc93d
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2016 wrote to memory of 2756 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe 71 PID 2016 wrote to memory of 2756 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe 71 PID 2016 wrote to memory of 2756 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe 71 - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: 33 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Token: SeIncBasePriorityPrivilege 2016 dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe - Modifies Windows Firewall 1 TTPs
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\68cd8d32a94dcb323a57eaa58aa57bd4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe\" .." dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\68cd8d32a94dcb323a57eaa58aa57bd4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe\" .." dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\68cd8d32a94dcb323a57eaa58aa57bd4.exe dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\68cd8d32a94dcb323a57eaa58aa57bd4.exe dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe"C:\Users\Admin\AppData\Local\Temp\dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
- Drops startup file
PID:2016 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe" "dfa0c14670f8df1eac3e005262e901622c0ec1ccdcc91fd8aedb93da5a32ad64.exe" ENABLE2⤵PID:2756
-