Analysis
-
max time kernel
146s -
max time network
152s -
platform
windows7_x64 -
resource
win7 -
submitted
09/07/2020, 11:14
Static task
static1
Behavioral task
behavioral1
Sample
32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe
-
Size
32KB
-
MD5
948dc49c28886bc4a371176123724bb1
-
SHA1
17d969deecbef6a54cfb7b1b39c0d3edc5ec0c58
-
SHA256
32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d
-
SHA512
5e43aad77b073f3eb9e1833b4633475643705d67da2c752f713d4f22441c1dbacae979e27637ec5292434ba2089d0ae6f4ea472aca9ea90cf136be84e92621ca
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 20 IoCs
description pid Process procid_target PID 900 wrote to memory of 1660 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 26 PID 900 wrote to memory of 1660 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 26 PID 900 wrote to memory of 1660 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 26 PID 900 wrote to memory of 1660 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 26 PID 900 wrote to memory of 1792 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 28 PID 900 wrote to memory of 1792 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 28 PID 900 wrote to memory of 1792 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 28 PID 900 wrote to memory of 1792 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 28 PID 1660 wrote to memory of 1840 1660 cmd.exe 30 PID 1660 wrote to memory of 1840 1660 cmd.exe 30 PID 1660 wrote to memory of 1840 1660 cmd.exe 30 PID 1660 wrote to memory of 1840 1660 cmd.exe 30 PID 1792 wrote to memory of 1852 1792 cmd.exe 31 PID 1792 wrote to memory of 1852 1792 cmd.exe 31 PID 1792 wrote to memory of 1852 1792 cmd.exe 31 PID 1792 wrote to memory of 1852 1792 cmd.exe 31 PID 1884 wrote to memory of 1920 1884 explorer.exe 33 PID 1884 wrote to memory of 1920 1884 explorer.exe 33 PID 1884 wrote to memory of 1920 1884 explorer.exe 33 PID 1884 wrote to memory of 1920 1884 explorer.exe 33 -
Executes dropped EXE 1 IoCs
pid Process 1920 WinServices.exe -
Modifies service 2 TTPs 30 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance WinServices.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1022 = "132387668735204000" WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 WinServices.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\BITS\Performance\1008 = "132387668733488000" WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage WinServices.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "2" WinServices.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\rdyboost\Performance\1023 = "132387668746280000" WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 WinServices.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage WinServices.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage WinServices.exe -
Looks up external IP address via web service 1 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 4 icanhazip.com -
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1840 schtasks.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe Token: SeDebugPrivilege 1920 WinServices.exe -
Suspicious behavior: EnumeratesProcesses 15 IoCs
pid Process 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 900 32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe 1920 WinServices.exe 1920 WinServices.exe 1920 WinServices.exe 1920 WinServices.exe 1920 WinServices.exe 1920 WinServices.exe 1920 WinServices.exe 1920 WinServices.exe 1920 WinServices.exe 1920 WinServices.exe 1920 WinServices.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe"C:\Users\Admin\AppData\Local\Temp\32bcf0951b1cbe7e95d31e81b450aaf2ab3eb24374eda37266490ed61eb3aa0d.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:900 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c schtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"' & exit2⤵
- Suspicious use of WriteProcessMemory
PID:1660 -
C:\Windows\SysWOW64\schtasks.exeschtasks /create /f /sc onlogon /rl highest /tn WinServices /tr '"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"'3⤵
- Creates scheduled task(s)
PID:1840
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c explorer C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe2⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\explorer.exeexplorer C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe3⤵PID:1852
-
-
-
C:\Windows\explorer.exeC:\Windows\explorer.exe /factory,{75dff2b7-6936-4c06-a8bb-676a7b00b24b} -Embedding1⤵
- Suspicious use of WriteProcessMemory
PID:1884 -
C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"C:\Users\Admin\AppData\Local\Microsoft\Networking\WinServices.exe"2⤵
- Executes dropped EXE
- Modifies service
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1920
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1624