Analysis
- max time kernel
150s - max time network
151s - platform
windows10_x64 - resource
win10v20201028 - submitted
09/11/2020, 20:23
Static task
static1
Behavioral task
behavioral1
Sample
7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe
- Size 355KB
- Sample201109-zea14mx256
- SHA256 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b
- MD5 8e06cec4b5faf0db8f785f458b7dbce5
- SHA1 88d1e34c8affb27c48e52eaa9fa2b11145766fed
- SHA512 40629fafb865b87508ba019c57b8ea08f9f10d9c12d0773639a90ac0bda13e2c278ec571eea5cadff6ac0a507dedb01f6f618e93ea486c1cf636870ffcc474a4
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\userinit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\apppatch\\svchost.exe," svchost.exe - Executes dropped EXE 1 IoCs
pid Process 3400 svchost.exe - Modifies WinLogon 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\58f13080 = "\x1f\x13U\x12f\x14™E\x1aU«W>Õ•ð)âFÁþ»eU…Jv™éåCïÊštW\a’_Çîõ·5÷&‚ÖÇ%ZG7]\x06o\x1f]ÔFf\u009d%ä¦êiÚ,¬i\x1dVÂå\x0f¯^iWÂõÄÑNTŒ%qÂõ\"á¤\x06§ßÍ÷t)î\n„õN\t<wÏ\x19\rT\\¡ú\u007fÝ'¡\x1e:Y–¥ewá\r}Å’\u0081ížt\x05ün±~Ý%]²Ñ\u008f<QZ·Wå\u008f<mô\u008fR¡%,¯\x15\u00ad}A4ì1¦\x1dÄ\\ž\u008dǽE\x16'UÖ>×ñUÿ4ŸÅ&‚_ý¢ÿQÝNeåïïoÇÕv‰Äm…_•…?n,Yϧ9\x16tú\u009dÝ\a\u00ad\\Tç¥vw¬\x17<ñÉd2=É\x05\t2\x0f,žl\x17á:÷ì)RŽ·" 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\58f13080 = "\x1f\x13U\x12f\x14™E\x1aU«W>Õ•ð)âFÁþ»eU…Jv™éåCïÊštW\a’_Çîõ·5÷&‚ÖÇ%ZG7]\x06o\x1f]ÔFf\u009d%ä¦êiÚ,¬i\x1dVÂå\x0f¯^iWÂõÄÑNTŒ%qÂõ\"á¤\x06§ßÍ÷t)î\n„õN\t<wÏ\x19\rT\\¡ú\u007fÝ'¡\x1e:Y–¥ewá\r}Å’\u0081ížt\x05ün±~Ý%]²Ñ\u008f<QZ·Wå\u008f<mô\u008fR¡%,¯\x15\u00ad}A4ì1¦\x1dÄ\\ž\u008dǽE\x16'UÖ>×ñUÿ4ŸÅ&‚_ý¢ÿQÝNeåïïoÇÕv‰Äm…_•…?n,Yϧ9\x16tú\u009dÝ\a\u00ad\\Tç¥vw¬\x17<ñÉd2=É\x05\t2\x0f,žl\x17á:÷ì)RŽ·" svchost.exe - Drops file in Windows directory 2 IoCs
description ioc Process File created C:\Windows\apppatch\svchost.exe 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe File opened for modification C:\Windows\apppatch\svchost.exe 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe - Suspicious behavior: EnumeratesProcesses 298 IoCs
pid Process 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe 3400 svchost.exe - Suspicious behavior: RenamesItself 1 IoCs
pid Process 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 1272 wrote to memory of 3400 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe 74 PID 1272 wrote to memory of 3400 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe 74 PID 1272 wrote to memory of 3400 1272 7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe 74
Processes
-
C:\Users\Admin\AppData\Local\Temp\7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe"C:\Users\Admin\AppData\Local\Temp\7b673f65dfb02aea2b7fe950c749c17a953d2b9514aa78c663aac6c002b6bf6b.exe"1⤵
- Modifies WinLogon
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: RenamesItself
- Suspicious use of WriteProcessMemory
PID:1272 -
C:\Windows\apppatch\svchost.exe"C:\Windows\apppatch\svchost.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies WinLogon
- Suspicious behavior: EnumeratesProcesses
PID:3400
-