Analysis
- max time kernel
146s - max time network
151s - platform
windows7_x64 - resource
win7v20201028 - submitted
08/11/2020, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe
- Size 1.0MB
- Sample201108-m372jfc2fe
- SHA256 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398
- MD5 f51fa43a7f3f23279f7eedb8f9cf53dc
- SHA1 aebe8f8b4fdfc7fc851a2853b0174a1f7e9bffe8
- SHA512 f5848f698ba1816ec0112a67a8dbc0e62b7e5bd12c72ba084905388e3eaff8dbf2ec72d1912ed636061c44d65ec363d7be07fd0179dd51dbeb0792a417ade70b
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Modifies Installed Components in the registry 2 TTPs
- Deletes itself 1 IoCs
pid Process 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Loads dropped DLL 1 IoCs
pid Process 300 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\trkcore = "C:\\ProgramData\\Microsoft\\Roaming\\svchost.exe" ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs explorer.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification \??\c:\windows\installer\{ac76ba86-7ad7-1033-7b44-a90000000001}\pdffile_8.ico explorer.exe - Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe - Suspicious behavior: EnumeratesProcesses 9 IoCs
pid Process 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1260 explorer.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 300 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeShutdownPrivilege 1260 explorer.exe Token: SeShutdownPrivilege 1260 explorer.exe Token: SeShutdownPrivilege 1260 explorer.exe Token: SeShutdownPrivilege 1260 explorer.exe Token: SeShutdownPrivilege 1260 explorer.exe Token: SeShutdownPrivilege 1260 explorer.exe Token: SeShutdownPrivilege 1260 explorer.exe Token: SeShutdownPrivilege 1260 explorer.exe Token: 33 924 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 924 AUDIODG.EXE Token: 33 924 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 924 AUDIODG.EXE Token: SeShutdownPrivilege 1260 explorer.exe Token: SeShutdownPrivilege 1260 explorer.exe - Suspicious use of FindShellTrayWindow 25 IoCs
pid Process 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe - Suspicious use of SendNotifyMessage 28 IoCs
pid Process 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe 1260 explorer.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 1904 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 300 wrote to memory of 1904 300 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 25 PID 300 wrote to memory of 1904 300 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 25 PID 300 wrote to memory of 1904 300 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 25 PID 300 wrote to memory of 1904 300 ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe 25 - System policy modification 1 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe"C:\Users\Admin\AppData\Local\Temp\ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe"1⤵
- Loads dropped DLL
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:300 -
C:\Users\Admin\AppData\Local\Temp\ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exeC:\Users\Admin\AppData\Local\Temp\ee379be40d5c1621d1e0ccf136de363f950cbc92e5ee7f2b05c447cf8f6f2398.exe2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- System policy modification
PID:1904
-
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1220
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies service
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1260
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5781⤵
- Suspicious use of AdjustPrivilegeToken
PID:924