Analysis
- max time kernel
151s - max time network
154s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target file.exe
- Size 28KB
- Sample201109-cr7ryyth6x
- SHA256 78364eb0cc0cf381b000b9ae8f942bb4c94f342ba10827d7e7e4dd8ae3d140ff
- MD5 6b9cdcf373f4922a6dd2c2402e08d09e
- SHA1 0cf2958ff18648b652960fe0a9677152d2e225e1
- SHA512 e6afc94bc78ef19cc9b36720d8a4a7ad9c85d524026e241cdcc36eef452f437b098685c684318b93a44a740a2fa5885873817aa457441a6713b814d16fc3852b
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1424 Trojan.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe - Loads dropped DLL 1 IoCs
pid Process 1668 file.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe - Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe - Suspicious behavior: EnumeratesProcesses 36 IoCs
pid Process 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe 1424 Trojan.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1424 Trojan.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1668 wrote to memory of 1424 1668 file.exe 26 PID 1668 wrote to memory of 1424 1668 file.exe 26 PID 1668 wrote to memory of 1424 1668 file.exe 26 PID 1668 wrote to memory of 1424 1668 file.exe 26 PID 1424 wrote to memory of 1888 1424 Trojan.exe 27 PID 1424 wrote to memory of 1888 1424 Trojan.exe 27 PID 1424 wrote to memory of 1888 1424 Trojan.exe 27 PID 1424 wrote to memory of 1888 1424 Trojan.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1668 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵
- Modifies service
PID:1888
-
-