7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858

Analysis

max time kernel
149s
max time network
154s
platform
windows7_x64
resource
win7v200722
submitted
20/09/2020, 04:00

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
97fdb440587ae6f237203b2e0338a550.exe
Size 77KB
Sample200920-mbht23cwf2
SHA256 7f99d6f0dd72b4b86fa136ed7771fd55dd6b40e8f890d61b90d8a88d117c9858
MD5 97fdb440587ae6f237203b2e0338a550
SHA1 a8613ac0c99ea6d5073d7474b278794b50f30b24
SHA512 e9e339b95128af836f286fbce08f92ee20f492f4d669c1194c8eecaf86b62a9740301714a20c05a70c0b1d8b31119bff120e2146b19906183706783bee0633aa
MD5 SHA1 SHA512

Score

10^/10

upx evasion trojan persistence

Malware Config

Signatures

Windows security bypass 2 TTPs
evasion trojan

Disabling Security Tools
T1089

Modify Registry
T1112

Executes dropped EXE 6 IoCs

pid	Process
1892	svchost.exe
856	1120413378.exe
240	svchost.exe
644	2136733995.exe
1008	2163031140.exe
1468	26332.exe

UPX packed file 10 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1492-27-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1492-27-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1492-28-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1492-28-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1492-29-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1492-29-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1492-31-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1492-31-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1492-33-0x0000000000400000-0x0000000000A16000-memory.dmp	upx
behavioral1/memory/1492-33-0x0000000000400000-0x0000000000A16000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ulZYCdTsml.url	wscript.exe

Loads dropped DLL 7 IoCs

pid	Process
1332	97fdb440587ae6f237203b2e0338a550.exe
1892	svchost.exe
856	1120413378.exe
240	svchost.exe
240	svchost.exe
1008	2163031140.exe
1008	2163031140.exe

Windows security modification 2 TTPs 8 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1"	svchost.exe
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1"	svchost.exe

Adds Run key to start application 2 TTPs 4 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\17111072125695\\svchost.exe"	97fdb440587ae6f237203b2e0338a550.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\17111072125695\\svchost.exe"	97fdb440587ae6f237203b2e0338a550.exe
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\119592689627812\\svchost.exe"	1120413378.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\Host Process for Windows Services = "C:\\119592689627812\\svchost.exe"	1120413378.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1468 set thread context of 1492	1468	26332.exe	40

Suspicious behavior: EnumeratesProcesses 26 IoCs

pid	Process
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe
1468	26332.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1468	26332.exe
Token: SeLockMemoryPrivilege	1492	notepad.exe
Token: SeLockMemoryPrivilege	1492	notepad.exe

Suspicious use of WriteProcessMemory 42 IoCs

description	pid	Process	procid_target
PID 1332 wrote to memory of 1892	1332	97fdb440587ae6f237203b2e0338a550.exe	30
PID 1332 wrote to memory of 1892	1332	97fdb440587ae6f237203b2e0338a550.exe	30
PID 1332 wrote to memory of 1892	1332	97fdb440587ae6f237203b2e0338a550.exe	30
PID 1332 wrote to memory of 1892	1332	97fdb440587ae6f237203b2e0338a550.exe	30
PID 1892 wrote to memory of 856	1892	svchost.exe	32
PID 1892 wrote to memory of 856	1892	svchost.exe	32
PID 1892 wrote to memory of 856	1892	svchost.exe	32
PID 1892 wrote to memory of 856	1892	svchost.exe	32
PID 856 wrote to memory of 240	856	1120413378.exe	33
PID 856 wrote to memory of 240	856	1120413378.exe	33
PID 856 wrote to memory of 240	856	1120413378.exe	33
PID 856 wrote to memory of 240	856	1120413378.exe	33
PID 240 wrote to memory of 644	240	svchost.exe	35
PID 240 wrote to memory of 644	240	svchost.exe	35
PID 240 wrote to memory of 644	240	svchost.exe	35
PID 240 wrote to memory of 644	240	svchost.exe	35
PID 240 wrote to memory of 1008	240	svchost.exe	36
PID 240 wrote to memory of 1008	240	svchost.exe	36
PID 240 wrote to memory of 1008	240	svchost.exe	36
PID 240 wrote to memory of 1008	240	svchost.exe	36
PID 1008 wrote to memory of 1468	1008	2163031140.exe	37
PID 1008 wrote to memory of 1468	1008	2163031140.exe	37
PID 1008 wrote to memory of 1468	1008	2163031140.exe	37
PID 1008 wrote to memory of 1468	1008	2163031140.exe	37
PID 1468 wrote to memory of 1492	1468	26332.exe	40
PID 1468 wrote to memory of 1492	1468	26332.exe	40
PID 1468 wrote to memory of 1492	1468	26332.exe	40
PID 1468 wrote to memory of 1492	1468	26332.exe	40
PID 1468 wrote to memory of 1492	1468	26332.exe	40
PID 1468 wrote to memory of 1492	1468	26332.exe	40
PID 1468 wrote to memory of 1492	1468	26332.exe	40
PID 1468 wrote to memory of 1492	1468	26332.exe	40
PID 1468 wrote to memory of 1492	1468	26332.exe	40
PID 1468 wrote to memory of 1492	1468	26332.exe	40
PID 1468 wrote to memory of 1992	1468	26332.exe	41
PID 1468 wrote to memory of 1992	1468	26332.exe	41
PID 1468 wrote to memory of 1992	1468	26332.exe	41
PID 1468 wrote to memory of 1992	1468	26332.exe	41
PID 1992 wrote to memory of 1980	1992	cmd.exe	43
PID 1992 wrote to memory of 1980	1992	cmd.exe	43
PID 1992 wrote to memory of 1980	1992	cmd.exe	43
PID 1992 wrote to memory of 1980	1992	cmd.exe	43

C:\Users\Admin\AppData\Local\Temp\97fdb440587ae6f237203b2e0338a550.exe
"C:\Users\Admin\AppData\Local\Temp\97fdb440587ae6f237203b2e0338a550.exe"
1⤵
- Loads dropped DLL
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1332
- C:\17111072125695\svchost.exe
  C:\17111072125695\svchost.exe
  2⤵
  - Executes dropped EXE
  - Loads dropped DLL
  - Windows security modification
  - Suspicious use of WriteProcessMemory
  PID:1892
- - C:\Users\Admin\AppData\Local\Temp\1120413378.exe
    C:\Users\Admin\AppData\Local\Temp\1120413378.exe
    3⤵
    - Executes dropped EXE
    - Loads dropped DLL
    - Adds Run key to start application
    - Suspicious use of WriteProcessMemory
    PID:856
  - - C:\119592689627812\svchost.exe
      C:\119592689627812\svchost.exe
      4⤵
      Executes dropped EXE
      Loads dropped DLL
      Windows security modification
      Suspicious use of WriteProcessMemory
      PID:240
    - - C:\Users\Admin\AppData\Local\Temp\2136733995.exe
        
        C:\Users\Admin\AppData\Local\Temp\2136733995.exe
        5⤵
        Executes dropped EXE
        
        PID:644
    - - C:\Users\Admin\AppData\Local\Temp\2163031140.exe
        
        C:\Users\Admin\AppData\Local\Temp\2163031140.exe
        5⤵
        Executes dropped EXE
        Loads dropped DLL
        Suspicious use of WriteProcessMemory
        
        PID:1008
      - C:\Users\Admin\AppData\Local\Temp\26332.exe
        
        C:\Users\Admin\AppData\Local\Temp\26332.exe
        6⤵
        Executes dropped EXE
        Suspicious use of SetThreadContext
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        Suspicious use of WriteProcessMemory
        
        PID:1468
        
        C:\Windows\notepad.exe
        
        "C:\Windows\notepad.exe" -c "C:\ProgramData\PnQssBdbSh\cfgi"
        7⤵
        Suspicious use of AdjustPrivilegeToken
        
        PID:1492
        
        C:\Windows\SysWOW64\cmd.exe
        
        cmd.exe /C WScript "C:\ProgramData\PnQssBdbSh\r.vbs"
        7⤵
        Suspicious use of WriteProcessMemory
        
        PID:1992
        
        C:\Windows\SysWOW64\wscript.exe
        
        WScript "C:\ProgramData\PnQssBdbSh\r.vbs"
        8⤵
        Drops startup file
        
        PID:1980

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1468-25-0x0000000002C50000-0x0000000002C61000-memory.dmp

Download

memory/1468-24-0x0000000002980000-0x0000000002B4D000-memory.dmp

Download

memory/1492-31-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/1492-29-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/1492-28-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/1492-27-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/1492-33-0x0000000000400000-0x0000000000A16000-memory.dmp

Download

memory/1600-0-0x000007FEF70C0000-0x000007FEF733A000-memory.dmp

Download

memory/1980-37-0x00000000027A0000-0x00000000027A4000-memory.dmp

Download