Analysis
- max time kernel
76s - max time network
137s - platform
windows10_x64 - resource
win10v200722 - submitted
30/08/2020, 13:40
Static task
static1
Behavioral task
behavioral1
Sample
9a57ef7f5f2b6d8e22434b17c12492c6.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9a57ef7f5f2b6d8e22434b17c12492c6.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target 9a57ef7f5f2b6d8e22434b17c12492c6.exe
- Size 13.9MB
- Sample200830-jflakesepa
- SHA256 edcff9440f08358abcd5d2dc9c2e3868891150d9b4b8819c3bf69eb41d89b6b7
- MD5 9a57ef7f5f2b6d8e22434b17c12492c6
- SHA1 49157293787c0cc5f7ece9daf037bd49b02406cb
- SHA512 f05013cebc8d97e512c14edb66d0d5c6dbf25a47bde85344cee3f1411ef3e61ff1b516b7e050ee660e6779a1fbe1bd230544f2aa3762182df5a35319afbea281
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Checks for any installed AV software in registry 1 TTPs 48 IoCs
description ioc Process Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AhnLab\V3IS80 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir PersonalEdition Classic 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Workstation 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Desktop 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\AntiVirService 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Antivirus 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Eset\NOD\CurrentVersion\Info 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BAVSvc 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\QHActiveDefense 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\avast! Antivirus 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir PersonalEdition Premium 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Desktop 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\NOD\CurrentVersion\Info 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AhnLab\V3IS80 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\SOFTWARE\K7 Computing\K7TotalSecurity 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\AVAST Software\Avast 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Premium Security Suite 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\FRISK Software\F-PROT Antivirus for Windows 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Doctor Web\InstalledComponents 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\DrWebAVService 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Bitdefender\QuickScan 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Eset\NOD 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast\Exchange 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Server 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir Server 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Security 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Security 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS\Installer 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\Antivirus 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\a2AntiMalware 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir Workstation 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\AntiVir PersonalEdition Premium 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS\Installer 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVAST Software\Avast 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\AVG\AV 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVG\AV 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\KasperskyLab 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\COMODO\CIS 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\COMODO\CIS 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Eset\NOD 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\AVAST Software\Avast\Exchange 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\AntiVirService 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Avira\AntiVir PersonalEdition Classic 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Avira\Premium Security Suite 9a57ef7f5f2b6d8e22434b17c12492c6.exe Key opened \REGISTRY\MACHINE\SOFTWARE\Doctor Web\InstalledComponents 9a57ef7f5f2b6d8e22434b17c12492c6.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\ServiceProfiles\LocalService\winhttp\cachev3.dat svchost.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad svchost.exe Key created \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionReason = "1" svchost.exe Set value (data) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecisionTime = a850d058e37ed601 svchost.exe Set value (int) \REGISTRY\USER\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\0e-3e-6f-2c-c8-c7\WpadDecision = "0" svchost.exe - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 388 svchost.exe Token: SeCreatePagefilePrivilege 388 svchost.exe - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 3876 9a57ef7f5f2b6d8e22434b17c12492c6.exe 3876 9a57ef7f5f2b6d8e22434b17c12492c6.exe - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 3876 9a57ef7f5f2b6d8e22434b17c12492c6.exe 3876 9a57ef7f5f2b6d8e22434b17c12492c6.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3876 9a57ef7f5f2b6d8e22434b17c12492c6.exe 3876 9a57ef7f5f2b6d8e22434b17c12492c6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9a57ef7f5f2b6d8e22434b17c12492c6.exe"C:\Users\Admin\AppData\Local\Temp\9a57ef7f5f2b6d8e22434b17c12492c6.exe"1⤵
- Checks for any installed AV software in registry
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
- Suspicious use of SetWindowsHookEx
PID:3876
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
PID:388