Analysis
- max time kernel
153s - max time network
152s - platform
windows7_x64 - resource
win7v200722 - submitted
21/09/2020, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
F4r2rt5J.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
F4r2rt5J.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target F4r2rt5J.exe
- Size 32KB
- Sample200921-qcmsrsmcme
- SHA256 bc4660dc237469fbc12b99b5d83f007b4ea49932046adecc5cbb64a4dc2f10ec
- MD5 1e4a13204be3de886781aab51d691d02
- SHA1 8afff318235ad66da498907f18e2874229db52db
- SHA512 063cd5fa4bd59d50cd519f48fc9f2cc5c8ba2cd57883db5c09e8e2f3a4e9d0dba527d174436282ec56e2d53e4e8039096220f0803077e88b9378ea5c933dbc43
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1676 System32.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e433a12e0d25d217c94f79369f33fb57.exe System32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e433a12e0d25d217c94f79369f33fb57.exe System32.exe - Loads dropped DLL 1 IoCs
pid Process 828 F4r2rt5J.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\e433a12e0d25d217c94f79369f33fb57 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\e433a12e0d25d217c94f79369f33fb57 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe - Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe - Suspicious use of AdjustPrivilegeToken 31 IoCs
description pid Process Token: SeDebugPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe Token: 33 1676 System32.exe Token: SeIncBasePriorityPrivilege 1676 System32.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 828 wrote to memory of 1676 828 F4r2rt5J.exe 28 PID 828 wrote to memory of 1676 828 F4r2rt5J.exe 28 PID 828 wrote to memory of 1676 828 F4r2rt5J.exe 28 PID 828 wrote to memory of 1676 828 F4r2rt5J.exe 28 PID 1676 wrote to memory of 1868 1676 System32.exe 29 PID 1676 wrote to memory of 1868 1676 System32.exe 29 PID 1676 wrote to memory of 1868 1676 System32.exe 29 PID 1676 wrote to memory of 1868 1676 System32.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\F4r2rt5J.exe"C:\Users\Admin\AppData\Local\Temp\F4r2rt5J.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:828 -
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1676 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System32.exe" "System32.exe" ENABLE3⤵
- Modifies service
PID:1868
-
-