Analysis
- max time kernel
152s - max time network
139s - platform
windows7_x64 - resource
win7v200722 - submitted
24/09/2020, 06:03
Static task
static1
Behavioral task
behavioral1
Sample
SBgR9mj8.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SBgR9mj8.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target SBgR9mj8.exe
- Size 37KB
- Sample200924-sdtca6sats
- SHA256 1292e5a45426d40909dc8199da5fc6346a4b8a652baff6bacee9e64bb253f16c
- MD5 c7910e75169d715e239ec9ddfc7d1508
- SHA1 9fae7eaaf264b280d8d48057d8788cbba76bc4c3
- SHA512 f652406d90a0fd00a58c8f7159d7a5197f86d9940b64c7bf1e02b8d1b875dc8d1b460b5f05744a6fd6235038933cb5410f7d0297766cd60ec0663a0b57b56241
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fdb6a2048ccd0ff51cb30e142e8611b4.exe SBgR9mj8.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fdb6a2048ccd0ff51cb30e142e8611b4.exe SBgR9mj8.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2090973689-680783404-4292415065-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdb6a2048ccd0ff51cb30e142e8611b4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SBgR9mj8.exe\" .." SBgR9mj8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\fdb6a2048ccd0ff51cb30e142e8611b4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SBgR9mj8.exe\" .." SBgR9mj8.exe - Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe Token: 33 1504 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 1504 SBgR9mj8.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1504 wrote to memory of 1324 1504 SBgR9mj8.exe 28 PID 1504 wrote to memory of 1324 1504 SBgR9mj8.exe 28 PID 1504 wrote to memory of 1324 1504 SBgR9mj8.exe 28 PID 1504 wrote to memory of 1324 1504 SBgR9mj8.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\SBgR9mj8.exe"C:\Users\Admin\AppData\Local\Temp\SBgR9mj8.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\SBgR9mj8.exe" "SBgR9mj8.exe" ENABLE2⤵
- Modifies service
PID:1324
-