Analysis
- max time kernel
149s - max time network
133s - platform
windows10_x64 - resource
win10 - submitted
24/07/2020, 10:56
Static task
static1
Behavioral task
behavioral1
Sample
468d61ecfa9b0bac81704d8bee173f07.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
468d61ecfa9b0bac81704d8bee173f07.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 468d61ecfa9b0bac81704d8bee173f07.exe
- Size 319KB
- Sample200724-scxyftntj2
- SHA256 fa7942a25cea90d890bca23298576191b75723375e2106d8ada228a85bfcfa7f
- MD5 468d61ecfa9b0bac81704d8bee173f07
- SHA1 fccb0eba1bf75078c3b015afa23c745ea9879631
- SHA512 0fbab1ace917f2b9f0e0ba1a5c96b2b16e9749d590cbbc9a816b142f52b833b9671fb5aade030d843e26a45c11e06959752de9cd5bd36f26c6c12c3ba29bfaac
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2984 wrote to memory of 3968 2984 468d61ecfa9b0bac81704d8bee173f07.exe 67 PID 2984 wrote to memory of 3968 2984 468d61ecfa9b0bac81704d8bee173f07.exe 67 PID 2984 wrote to memory of 3968 2984 468d61ecfa9b0bac81704d8bee173f07.exe 67 PID 2984 wrote to memory of 3916 2984 468d61ecfa9b0bac81704d8bee173f07.exe 68 PID 2984 wrote to memory of 3916 2984 468d61ecfa9b0bac81704d8bee173f07.exe 68 PID 2984 wrote to memory of 3916 2984 468d61ecfa9b0bac81704d8bee173f07.exe 68 PID 2984 wrote to memory of 3864 2984 468d61ecfa9b0bac81704d8bee173f07.exe 69 PID 2984 wrote to memory of 3864 2984 468d61ecfa9b0bac81704d8bee173f07.exe 69 PID 2984 wrote to memory of 3864 2984 468d61ecfa9b0bac81704d8bee173f07.exe 69 PID 2984 wrote to memory of 3848 2984 468d61ecfa9b0bac81704d8bee173f07.exe 70 PID 2984 wrote to memory of 3848 2984 468d61ecfa9b0bac81704d8bee173f07.exe 70 PID 2984 wrote to memory of 3848 2984 468d61ecfa9b0bac81704d8bee173f07.exe 70 PID 2984 wrote to memory of 3848 2984 468d61ecfa9b0bac81704d8bee173f07.exe 70 PID 2984 wrote to memory of 3848 2984 468d61ecfa9b0bac81704d8bee173f07.exe 70 PID 2984 wrote to memory of 3848 2984 468d61ecfa9b0bac81704d8bee173f07.exe 70 PID 2984 wrote to memory of 3848 2984 468d61ecfa9b0bac81704d8bee173f07.exe 70 PID 3848 wrote to memory of 3328 3848 468d61ecfa9b0bac81704d8bee173f07.exe 71 PID 3848 wrote to memory of 3328 3848 468d61ecfa9b0bac81704d8bee173f07.exe 71 PID 3848 wrote to memory of 3328 3848 468d61ecfa9b0bac81704d8bee173f07.exe 71 PID 3328 wrote to memory of 1184 3328 svchost.exe 78 PID 3328 wrote to memory of 1184 3328 svchost.exe 78 PID 3328 wrote to memory of 1184 3328 svchost.exe 78 PID 3328 wrote to memory of 1184 3328 svchost.exe 78 PID 3328 wrote to memory of 1184 3328 svchost.exe 78 PID 3328 wrote to memory of 1184 3328 svchost.exe 78 PID 3328 wrote to memory of 1184 3328 svchost.exe 78 PID 1184 wrote to memory of 1364 1184 svchost.exe 79 PID 1184 wrote to memory of 1364 1184 svchost.exe 79 PID 1184 wrote to memory of 1364 1184 svchost.exe 79 - Suspicious use of AdjustPrivilegeToken 16 IoCs
description pid Process Token: SeDebugPrivilege 2984 468d61ecfa9b0bac81704d8bee173f07.exe Token: SeDebugPrivilege 1184 svchost.exe Token: 33 1184 svchost.exe Token: SeIncBasePriorityPrivilege 1184 svchost.exe Token: 33 1184 svchost.exe Token: SeIncBasePriorityPrivilege 1184 svchost.exe Token: 33 1184 svchost.exe Token: SeIncBasePriorityPrivilege 1184 svchost.exe Token: 33 1184 svchost.exe Token: SeIncBasePriorityPrivilege 1184 svchost.exe Token: 33 1184 svchost.exe Token: SeIncBasePriorityPrivilege 1184 svchost.exe Token: 33 1184 svchost.exe Token: SeIncBasePriorityPrivilege 1184 svchost.exe Token: 33 1184 svchost.exe Token: SeIncBasePriorityPrivilege 1184 svchost.exe - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 2984 468d61ecfa9b0bac81704d8bee173f07.exe 2984 468d61ecfa9b0bac81704d8bee173f07.exe 2984 468d61ecfa9b0bac81704d8bee173f07.exe 2984 468d61ecfa9b0bac81704d8bee173f07.exe 2984 468d61ecfa9b0bac81704d8bee173f07.exe 2984 468d61ecfa9b0bac81704d8bee173f07.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 2984 set thread context of 3848 2984 468d61ecfa9b0bac81704d8bee173f07.exe 70 PID 3328 set thread context of 1184 3328 svchost.exe 78 - Executes dropped EXE 2 IoCs
pid Process 3328 svchost.exe 1184 svchost.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\9cc46706450f2c8e8ab2adc8b2288d24 = "\"C:\\Users\\Admin\\svchost.exe\" .." svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\9cc46706450f2c8e8ab2adc8b2288d24 = "\"C:\\Users\\Admin\\svchost.exe\" .." svchost.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9cc46706450f2c8e8ab2adc8b2288d24.exe svchost.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\9cc46706450f2c8e8ab2adc8b2288d24.exe svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\468d61ecfa9b0bac81704d8bee173f07.exe"C:\Users\Admin\AppData\Local\Temp\468d61ecfa9b0bac81704d8bee173f07.exe"1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:2984 -
C:\Users\Admin\AppData\Local\Temp\468d61ecfa9b0bac81704d8bee173f07.exe"{path}"2⤵PID:3968
-
-
C:\Users\Admin\AppData\Local\Temp\468d61ecfa9b0bac81704d8bee173f07.exe"{path}"2⤵PID:3916
-
-
C:\Users\Admin\AppData\Local\Temp\468d61ecfa9b0bac81704d8bee173f07.exe"{path}"2⤵PID:3864
-
-
C:\Users\Admin\AppData\Local\Temp\468d61ecfa9b0bac81704d8bee173f07.exe"{path}"2⤵
- Suspicious use of WriteProcessMemory
PID:3848 -
C:\Users\Admin\svchost.exe"C:\Users\Admin\svchost.exe"3⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:3328 -
C:\Users\Admin\svchost.exe"{path}"4⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of AdjustPrivilegeToken
- Executes dropped EXE
- Adds Run key to start application
- Drops startup file
PID:1184 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\svchost.exe" "svchost.exe" ENABLE5⤵PID:1364
-
-
-
-