Analysis
- max time kernel
146s - max time network
145s - platform
windows7_x64 - resource
win7 - submitted
06/07/2020, 07:13
Static task
static1
Behavioral task
behavioral1
Sample
ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe
- Size 241KB
- Sample200706-cwj3ejef4e
- SHA256 ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce
- MD5 8e8ca004cdfbd7e8a875f7d316ea4c5d
- SHA1 165259ef2384cbac2fd85be26d9a509e18d7e38e
- SHA512 959eb8d3686e445badf7ced9b23d8569b301790137fb08d76c1bf1c1057730f49771b7a0b5e76068e5682bf397140f82ac3a522ed83ac5c4b54d8c877e86083e
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 1 TTPs
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\5924217697c4db2fe2069ffa7b4cca66 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5924217697c4db2fe2069ffa7b4cca66 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe - Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe - Loads dropped DLL 1 IoCs
pid Process 1060 ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1060 wrote to memory of 1424 1060 ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe 24 PID 1060 wrote to memory of 1424 1060 ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe 24 PID 1060 wrote to memory of 1424 1060 ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe 24 PID 1060 wrote to memory of 1424 1060 ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe 24 PID 1424 wrote to memory of 296 1424 server.exe 25 PID 1424 wrote to memory of 296 1424 server.exe 25 PID 1424 wrote to memory of 296 1424 server.exe 25 PID 1424 wrote to memory of 296 1424 server.exe 25 - Executes dropped EXE 1 IoCs
pid Process 1424 server.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeDebugPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe Token: 33 1424 server.exe Token: SeIncBasePriorityPrivilege 1424 server.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe"C:\Users\Admin\AppData\Local\Temp\ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:1424 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵
- Modifies service
PID:296
-
-