Analysis
- max time kernel
150s - max time network
42s - platform
windows7_x64 - resource
win7v20201028 - submitted
09/11/2020, 20:49
Static task
static1
Behavioral task
behavioral1
Sample
d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe
- Size 153KB
- Sample201109-xcctxbs4de
- SHA256 d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305
- MD5 e7bc56b31ec2efc7403b8ce0b5cb11dc
- SHA1 c564506630447f2d459df3965ef90f5e3093019d
- SHA512 e234b19275d341552f3517ff2d1524075d075f81c3de8745824b2e42e027085e5f0b24bbead791ef2d06c747a7319f9014490b867cb9df46c3e9b6b20bfcbbfd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1352 servernj.exe - Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\db359fc145336cd1e88daafba00d0eb3.exe servernj.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\db359fc145336cd1e88daafba00d0eb3.exe servernj.exe - Loads dropped DLL 1 IoCs
pid Process 364 d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\db359fc145336cd1e88daafba00d0eb3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\servernj.exe\" .." servernj.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\db359fc145336cd1e88daafba00d0eb3 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\servernj.exe\" .." servernj.exe - Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe - Suspicious use of AdjustPrivilegeToken 34 IoCs
description pid Process Token: SeDebugPrivilege 364 d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe Token: 33 364 d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe Token: SeIncBasePriorityPrivilege 364 d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe Token: SeDebugPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe Token: 33 1352 servernj.exe Token: SeIncBasePriorityPrivilege 1352 servernj.exe - Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 364 wrote to memory of 1352 364 d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe 29 PID 364 wrote to memory of 1352 364 d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe 29 PID 364 wrote to memory of 1352 364 d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe 29 PID 364 wrote to memory of 1352 364 d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe 29 PID 1352 wrote to memory of 1456 1352 servernj.exe 30 PID 1352 wrote to memory of 1456 1352 servernj.exe 30 PID 1352 wrote to memory of 1456 1352 servernj.exe 30 PID 1352 wrote to memory of 1456 1352 servernj.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe"C:\Users\Admin\AppData\Local\Temp\d47e8c71a8d7cd1722e5b09574c818f4db65ecb4e9696fedbe738ff29f0a6305.exe"1⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\Temp\servernj.exe"C:\Users\Admin\AppData\Local\Temp\servernj.exe"2⤵
- Executes dropped EXE
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1352 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\servernj.exe" "servernj.exe" ENABLE3⤵
- Modifies service
PID:1456
-
-