Analysis
- max time kernel
151s - max time network
140s - platform
windows10_x64 - resource
win10v200722 - submitted
24/09/2020, 06:03
Static task
static1
Behavioral task
behavioral1
Sample
SBgR9mj8.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
SBgR9mj8.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
General
- Target SBgR9mj8.exe
- Size 37KB
- Sample200924-sdtca6sats
- SHA256 1292e5a45426d40909dc8199da5fc6346a4b8a652baff6bacee9e64bb253f16c
- MD5 c7910e75169d715e239ec9ddfc7d1508
- SHA1 9fae7eaaf264b280d8d48057d8788cbba76bc4c3
- SHA512 f652406d90a0fd00a58c8f7159d7a5197f86d9940b64c7bf1e02b8d1b875dc8d1b460b5f05744a6fd6235038933cb5410f7d0297766cd60ec0663a0b57b56241
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fdb6a2048ccd0ff51cb30e142e8611b4.exe SBgR9mj8.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\fdb6a2048ccd0ff51cb30e142e8611b4.exe SBgR9mj8.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1400429095-533421673-2598934218-1000\Software\Microsoft\Windows\CurrentVersion\Run\fdb6a2048ccd0ff51cb30e142e8611b4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SBgR9mj8.exe\" .." SBgR9mj8.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\fdb6a2048ccd0ff51cb30e142e8611b4 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\SBgR9mj8.exe\" .." SBgR9mj8.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe Token: 33 728 SBgR9mj8.exe Token: SeIncBasePriorityPrivilege 728 SBgR9mj8.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 728 wrote to memory of 1804 728 SBgR9mj8.exe 76 PID 728 wrote to memory of 1804 728 SBgR9mj8.exe 76 PID 728 wrote to memory of 1804 728 SBgR9mj8.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\SBgR9mj8.exe"C:\Users\Admin\AppData\Local\Temp\SBgR9mj8.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:728 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\SBgR9mj8.exe" "SBgR9mj8.exe" ENABLE2⤵PID:1804
-