Analysis
- max time kernel
150s - max time network
150s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 19:28
Static task
static1
Behavioral task
behavioral1
Sample
file.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
file.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target file.exe
- Size 28KB
- Sample201109-cr7ryyth6x
- SHA256 78364eb0cc0cf381b000b9ae8f942bb4c94f342ba10827d7e7e4dd8ae3d140ff
- MD5 6b9cdcf373f4922a6dd2c2402e08d09e
- SHA1 0cf2958ff18648b652960fe0a9677152d2e225e1
- SHA512 e6afc94bc78ef19cc9b36720d8a4a7ad9c85d524026e241cdcc36eef452f437b098685c684318b93a44a740a2fa5885873817aa457441a6713b814d16fc3852b
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 2540 Trojan.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\5cd8f17f4086744065eb0992a09e05a2.exe Trojan.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\5cd8f17f4086744065eb0992a09e05a2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\Trojan.exe\" .." Trojan.exe - Suspicious behavior: EnumeratesProcesses 48 IoCs
pid Process 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe 2540 Trojan.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2540 Trojan.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 980 wrote to memory of 2540 980 file.exe 75 PID 980 wrote to memory of 2540 980 file.exe 75 PID 980 wrote to memory of 2540 980 file.exe 75 PID 2540 wrote to memory of 3144 2540 Trojan.exe 76 PID 2540 wrote to memory of 3144 2540 Trojan.exe 76 PID 2540 wrote to memory of 3144 2540 Trojan.exe 76
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Users\Admin\AppData\Local\Temp\Trojan.exe"C:\Users\Admin\AppData\Local\Temp\Trojan.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2540 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\Trojan.exe" "Trojan.exe" ENABLE3⤵PID:3144
-
-