Analysis
-
max time kernel
144s -
max time network
140s -
platform
windows10_x64 -
resource
win10 -
submitted
09/07/2020, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe
-
Size
28KB
-
MD5
dcc35e49ac1c768d838efe3b161fb5f9
-
SHA1
50371cc42402d94cfb43e9942d1a506174839eb1
-
SHA256
8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36
-
SHA512
49cdeeca2e02fbea5d541bb2198eca81b34359714392efdf1e6f5eb460c339c03f7d3c2e0482915e0c211fda0932bd174a8eb3a18f1de24d36103ad27f94cb20
Score
8/10
Malware Config
Signatures
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 3008 schtasks.exe -
Modifies service 2 TTPs 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Data\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for Oracle\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking 4.0.0.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 WinServices.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\rdyboost\Performance\1023 = "132387669269954667" WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage WinServices.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance\1008 = "132387669265110916" WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for SqlServer\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 WinServices.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 3 icanhazip.com -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe Token: SeDebugPrivilege 2752 WinServices.exe -
Suspicious behavior: EnumeratesProcesses 37 IoCs
pid Process 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe 2752 WinServices.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 3588 wrote to memory of 3768 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 69 PID 3588 wrote to memory of 3768 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 69 PID 3588 wrote to memory of 3768 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 69 PID 3588 wrote to memory of 3492 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 71 PID 3588 wrote to memory of 3492 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 71 PID 3588 wrote to memory of 3492 3588 8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe 71 PID 3768 wrote to memory of 3008 3768 cmd.exe 73 PID 3768 wrote to memory of 3008 3768 cmd.exe 73 PID 3768 wrote to memory of 3008 3768 cmd.exe 73 PID 3492 wrote to memory of 3708 3492 cmd.exe 74 PID 3492 wrote to memory of 3708 3492 cmd.exe 74 PID 3492 wrote to memory of 3708 3492 cmd.exe 74 PID 2968 wrote to memory of 2752 2968 explorer.exe 76 PID 2968 wrote to memory of 2752 2968 explorer.exe 76 PID 2968 wrote to memory of 2752 2968 explorer.exe 76 -
Executes dropped EXE 1 IoCs
pid Process 2752 WinServices.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe"C:\Users\Admin\AppData\Local\Temp\8957d0b2b03b8f56fa7d60f4cafbe98f12adae548e66e21ec25e5cb224979e36.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:3768 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"'3⤵
- Creates scheduled task(s)
PID:3008
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c explorer C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe2⤵
- Suspicious use of WriteProcessMemory
PID:3492 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe3⤵PID:3708
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:2968 -
C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"2⤵
- Modifies service
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Executes dropped EXE
PID:2752
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:808