Analysis
-
max time kernel
145s -
max time network
34s -
platform
windows7_x64 -
resource
win7v200722 -
submitted
16-08-2020 15:20
Static task
static1
Behavioral task
behavioral1
Sample
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe
-
Size
72KB
-
MD5
052ccfcaf3c8f4008d8cdd8c473c879c
-
SHA1
87d7f7484426a11b75b56e5057df507593cead93
-
SHA256
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973
-
SHA512
d989bbb902658873cdaae07271235f6801010960aac9be6237096274ef38b9a34d374e6534c57e5fc94837857c92f689cf05df397ee43fb50e3fdb9fb63cc398
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
Processes:
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "userinit.exe,C:\\Windows\\host32.exe," 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exedescription pid process target process PID 1304 set thread context of 1344 1304 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe -
Drops file in Windows directory 2 IoCs
Processes:
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exedescription ioc process File opened for modification C:\Windows\host32.exe 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe File created C:\Windows\host32.exe 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exepid process 1344 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe 1344 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exedescription pid process Token: SeDebugPrivilege 1344 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exedescription pid process target process PID 1304 wrote to memory of 1344 1304 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe PID 1304 wrote to memory of 1344 1304 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe PID 1304 wrote to memory of 1344 1304 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe PID 1304 wrote to memory of 1344 1304 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe PID 1304 wrote to memory of 1344 1304 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe PID 1304 wrote to memory of 1344 1304 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe PID 1304 wrote to memory of 1344 1304 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe PID 1304 wrote to memory of 1344 1304 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe 1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe"C:\Users\Admin\AppData\Local\Temp\1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe"C:\Users\Admin\AppData\Local\Temp\1283285b7d4791bacfcbd29c8d579785b75a636d1e1866d8219600a353bb8973.exe"2⤵
- Modifies WinLogon for persistence
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken