Analysis
- max time kernel
148s - max time network
147s - platform
windows10_x64 - resource
win10 - submitted
06/07/2020, 07:13
Static task
static1
Behavioral task
behavioral1
Sample
ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe
- Size 241KB
- Sample200706-cwj3ejef4e
- SHA256 ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce
- MD5 8e8ca004cdfbd7e8a875f7d316ea4c5d
- SHA1 165259ef2384cbac2fd85be26d9a509e18d7e38e
- SHA512 959eb8d3686e445badf7ced9b23d8569b301790137fb08d76c1bf1c1057730f49771b7a0b5e76068e5682bf397140f82ac3a522ed83ac5c4b54d8c877e86083e
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 792 wrote to memory of 3880 792 ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe 66 PID 792 wrote to memory of 3880 792 ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe 66 PID 792 wrote to memory of 3880 792 ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe 66 PID 3880 wrote to memory of 3876 3880 server.exe 67 PID 3880 wrote to memory of 3876 3880 server.exe 67 PID 3880 wrote to memory of 3876 3880 server.exe 67 - Executes dropped EXE 1 IoCs
pid Process 3880 server.exe - Suspicious use of AdjustPrivilegeToken 53 IoCs
description pid Process Token: SeDebugPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe Token: 33 3880 server.exe Token: SeIncBasePriorityPrivilege 3880 server.exe - Modifies Windows Firewall 1 TTPs
- Adds Run entry to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\5924217697c4db2fe2069ffa7b4cca66 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5924217697c4db2fe2069ffa7b4cca66 = "\"C:\\Users\\Admin\\AppData\\Roaming\\server.exe\" .." server.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe"C:\Users\Admin\AppData\Local\Temp\ddbf8cb72cd40ae9effa10fc0448600eedef3ab6891a9419eb6960d804a89bce.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Users\Admin\AppData\Roaming\server.exe"C:\Users\Admin\AppData\Roaming\server.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
- Adds Run entry to start application
PID:3880 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Roaming\server.exe" "server.exe" ENABLE3⤵PID:3876
-
-