Analysis
- max time kernel
150s - max time network
141s - platform
windows10_x64 - resource
win10 - submitted
21/09/2020, 10:48
Static task
static1
Behavioral task
behavioral1
Sample
F4r2rt5J.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
F4r2rt5J.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target F4r2rt5J.exe
- Size 32KB
- Sample200921-qcmsrsmcme
- SHA256 bc4660dc237469fbc12b99b5d83f007b4ea49932046adecc5cbb64a4dc2f10ec
- MD5 1e4a13204be3de886781aab51d691d02
- SHA1 8afff318235ad66da498907f18e2874229db52db
- SHA512 063cd5fa4bd59d50cd519f48fc9f2cc5c8ba2cd57883db5c09e8e2f3a4e9d0dba527d174436282ec56e2d53e4e8039096220f0803077e88b9378ea5c933dbc43
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1096 System32.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e433a12e0d25d217c94f79369f33fb57.exe System32.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\e433a12e0d25d217c94f79369f33fb57.exe System32.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\e433a12e0d25d217c94f79369f33fb57 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\e433a12e0d25d217c94f79369f33fb57 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\System32.exe\" .." System32.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe Token: 33 1096 System32.exe Token: SeIncBasePriorityPrivilege 1096 System32.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 3828 wrote to memory of 1096 3828 F4r2rt5J.exe 76 PID 3828 wrote to memory of 1096 3828 F4r2rt5J.exe 76 PID 3828 wrote to memory of 1096 3828 F4r2rt5J.exe 76 PID 1096 wrote to memory of 1376 1096 System32.exe 77 PID 1096 wrote to memory of 1376 1096 System32.exe 77 PID 1096 wrote to memory of 1376 1096 System32.exe 77
Processes
-
C:\Users\Admin\AppData\Local\Temp\F4r2rt5J.exe"C:\Users\Admin\AppData\Local\Temp\F4r2rt5J.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3828 -
C:\Users\Admin\AppData\Local\Temp\System32.exe"C:\Users\Admin\AppData\Local\Temp\System32.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1096 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\System32.exe" "System32.exe" ENABLE3⤵PID:1376
-
-