Analysis
- max time kernel
129s - max time network
116s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/11/2020, 18:23
Static task
static1
Behavioral task
behavioral1
Sample
bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe
- Size 768KB
- Sample201108-vav862br8a
- SHA256 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2
- MD5 51361fbe8c81449acf395d2b29d13a4e
- SHA1 78ff64fe0c75cd6f788f7d6a81c95c501f387f66
- SHA512 1f77c91480306048ebec6aa643aee4e6cf902a2c2415ed597640656c57174c803b33f891378c2f4e2bbd28d29ea980ac6d57e9467b605a5ed5d48fbb7e5144e7
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Modifies Installed Components in the registry 2 TTPs
- Deletes itself 1 IoCs
pid Process 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\trkcore = "C:\\ProgramData\\Microsoft\\Roaming\\svchost.exe" bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Enumerates connected drives 3 TTPs 1 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\D: explorer.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs
pid Process 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Program crash 9 IoCs
pid pid_target Process procid_target 1180 3160 WerFault.exe 67 3736 2824 WerFault.exe 77 200 2824 WerFault.exe 77 3264 2824 WerFault.exe 77 1560 2824 WerFault.exe 77 3124 2824 WerFault.exe 77 2912 2824 WerFault.exe 77 1456 2824 WerFault.exe 77 3876 2824 WerFault.exe 77 - Modifies Control Panel 3 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\LastUpdated = "4294967295" explorer.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop explorer.exe Set value (int) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Control Panel\Desktop\TranscodedImageCount = "1" explorer.exe - Modifies registry class 7 IoCs
description ioc Process Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = 00000000ffffffff explorer.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{4336a54d-038b-4685-ab02-99bb52d3fb8b}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\CLSID\{018D5C66-4533-4307-9B53-224DE2ED1FE6}\Instance explorer.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings explorer.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000_Classes\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots = 02 explorer.exe - Suspicious behavior: EnumeratesProcesses 150 IoCs
pid Process 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 1180 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 3736 WerFault.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 200 WerFault.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 3264 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 1560 WerFault.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 3124 WerFault.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2912 WerFault.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 1456 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 3876 WerFault.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 3160 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeRestorePrivilege 1180 WerFault.exe Token: SeBackupPrivilege 1180 WerFault.exe Token: SeDebugPrivilege 1180 WerFault.exe Token: SeDebugPrivilege 3736 WerFault.exe Token: SeDebugPrivilege 200 WerFault.exe Token: SeDebugPrivilege 3264 WerFault.exe Token: SeDebugPrivilege 1560 WerFault.exe Token: SeDebugPrivilege 3124 WerFault.exe Token: SeDebugPrivilege 2912 WerFault.exe Token: SeDebugPrivilege 1456 WerFault.exe Token: SeDebugPrivilege 3876 WerFault.exe Token: SeShutdownPrivilege 3640 explorer.exe Token: SeCreatePagefilePrivilege 3640 explorer.exe Token: SeShutdownPrivilege 3640 explorer.exe Token: SeCreatePagefilePrivilege 3640 explorer.exe Token: SeShutdownPrivilege 3640 explorer.exe Token: SeCreatePagefilePrivilege 3640 explorer.exe Token: SeShutdownPrivilege 3640 explorer.exe Token: SeCreatePagefilePrivilege 3640 explorer.exe Token: SeShutdownPrivilege 3640 explorer.exe Token: SeCreatePagefilePrivilege 3640 explorer.exe - Suspicious use of FindShellTrayWindow 6 IoCs
pid Process 3928 sihost.exe 3640 explorer.exe 3640 explorer.exe 3640 explorer.exe 3640 explorer.exe 3640 explorer.exe - Suspicious use of SendNotifyMessage 9 IoCs
pid Process 3640 explorer.exe 3640 explorer.exe 3640 explorer.exe 3640 explorer.exe 3640 explorer.exe 3640 explorer.exe 3640 explorer.exe 3640 explorer.exe 3640 explorer.exe - Suspicious use of UnmapMainImage 1 IoCs
pid Process 2824 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe - Suspicious use of WriteProcessMemory 5 IoCs
description pid Process procid_target PID 3160 wrote to memory of 2824 3160 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 77 PID 3160 wrote to memory of 2824 3160 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 77 PID 3160 wrote to memory of 2824 3160 bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe 77 PID 3928 wrote to memory of 1184 3928 sihost.exe 93 PID 3928 wrote to memory of 1184 3928 sihost.exe 93 - System policy modification 1 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableTaskMgr = "1" bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe"C:\Users\Admin\AppData\Local\Temp\bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:3160 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 3160 -s 3402⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1180
-
-
C:\Users\Admin\AppData\Local\Temp\bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exeC:\Users\Admin\AppData\Local\Temp\bbdd92fe560df908080324d2c514af5c674f1aa2b8c4b65d5a37a5cd6ccbbba2.exe2⤵
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of UnmapMainImage
- System policy modification
PID:2824 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 3043⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3736
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 5803⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:200
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 6923⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:3264
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 7043⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1560
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 7083⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3124
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 8563⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:2912
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 9483⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:1456
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2824 -s 11963⤵
- Program crash
- Suspicious use of AdjustPrivilegeToken
PID:3876
-
-
-
\??\c:\windows\system32\sihost.exesihost.exe1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:3928 -
C:\Windows\explorer.exeexplorer.exe /LOADSAVEDWINDOWS2⤵PID:1184
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k UnistackSvcGroup -s CDPUserSvc1⤵PID:2084
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Enumerates connected drives
- Modifies Control Panel
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:3640