Analysis
- max time kernel
150s - max time network
104s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:45
Static task
static1
Behavioral task
behavioral1
Sample
e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe
- Size 396KB
- Sample201109-azzmxvvacj
- SHA256 e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13
- MD5 3b1293fdeb309e83bd1637bd039c0561
- SHA1 3e28198f5dd181ffc3f2ffb26e5b096a8dd12d3e
- SHA512 05216d6d995c2a1ebd49c85a2f91993ddc0ea6ad6dd9f56f86b6cc0331366c5bb0cd41f61bf0466c6ac13fa654f2e1249e68d2c293216ec16aaba1468165a2cb
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 512 server.exe 816 server.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1579703444a5d397a491c60a5505be31.exe server.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1579703444a5d397a491c60a5505be31.exe server.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\1579703444a5d397a491c60a5505be31 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1579703444a5d397a491c60a5505be31 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\server.exe\" .." server.exe - Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4756 set thread context of 4192 4756 e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe 78 PID 512 set thread context of 816 512 server.exe 80 - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 4756 e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe Token: SeDebugPrivilege 512 server.exe Token: SeDebugPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe Token: 33 816 server.exe Token: SeIncBasePriorityPrivilege 816 server.exe - Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 4756 wrote to memory of 4192 4756 e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe 78 PID 4756 wrote to memory of 4192 4756 e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe 78 PID 4756 wrote to memory of 4192 4756 e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe 78 PID 4756 wrote to memory of 4192 4756 e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe 78 PID 4756 wrote to memory of 4192 4756 e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe 78 PID 4192 wrote to memory of 512 4192 e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe 79 PID 4192 wrote to memory of 512 4192 e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe 79 PID 4192 wrote to memory of 512 4192 e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe 79 PID 512 wrote to memory of 816 512 server.exe 80 PID 512 wrote to memory of 816 512 server.exe 80 PID 512 wrote to memory of 816 512 server.exe 80 PID 512 wrote to memory of 816 512 server.exe 80 PID 512 wrote to memory of 816 512 server.exe 80 PID 816 wrote to memory of 616 816 server.exe 81 PID 816 wrote to memory of 616 816 server.exe 81 PID 816 wrote to memory of 616 816 server.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe"C:\Users\Admin\AppData\Local\Temp\e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4756 -
C:\Users\Admin\AppData\Local\Temp\e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exeC:\Users\Admin\AppData\Local\Temp\e4aae9a8a9103086b7232aa674f4ba296e140a4baaa01eb86b0cd79305a5fd13.exe2⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Users\Admin\AppData\Local\Temp\server.exe"C:\Users\Admin\AppData\Local\Temp\server.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:512 -
C:\Users\Admin\AppData\Local\Temp\server.exeC:\Users\Admin\AppData\Local\Temp\server.exe4⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:816 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\server.exe" "server.exe" ENABLE5⤵PID:616
-
-
-
-