Analysis
- max time kernel
151s - max time network
144s - platform
windows7_x64 - resource
win7v20201028 - submitted
10/11/2020, 11:37
Static task
static1
Behavioral task
behavioral1
Sample
8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe
- Size 221KB
- Sample201110-ref2pzyw4j
- SHA256 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e
- MD5 3d10157eac54df70002fb4942e20572c
- SHA1 00b790fbeb628f96c43bf041324520c86fae920f
- SHA512 93cebd54535191d17a8bed85baf318a4995d1f1ce8d827b39442dbf27aaec464829148ff58291ce04d3790de81d8353641ffed88581be7483a34add220b319bc
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\PING32.exe" PING32.exe - Executes dropped EXE 4 IoCs
pid Process 1572 PING32.exe 988 PING32.exe 1524 PING32.exe 1660 PING32.exe - Deletes itself 1 IoCs
pid Process 792 cmd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*PING32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe" 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\PING32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe" 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage PING32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 PING32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage PING32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "4" PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage PING32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 PING32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage PING32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 PING32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage PING32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 PING32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1021 = "132494921387384512" PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage PING32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 PING32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage PING32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 PING32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 PING32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1652 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1492 timeout.exe - Suspicious behavior: EnumeratesProcesses 65 IoCs
pid Process 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe 1572 PING32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1572 PING32.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1916 wrote to memory of 1572 1916 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe 29 PID 1916 wrote to memory of 1572 1916 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe 29 PID 1916 wrote to memory of 1572 1916 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe 29 PID 1916 wrote to memory of 1624 1916 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe 30 PID 1916 wrote to memory of 1624 1916 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe 30 PID 1916 wrote to memory of 1624 1916 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe 30 PID 1916 wrote to memory of 792 1916 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe 31 PID 1916 wrote to memory of 792 1916 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe 31 PID 1916 wrote to memory of 792 1916 8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe 31 PID 792 wrote to memory of 1492 792 cmd.exe 34 PID 792 wrote to memory of 1492 792 cmd.exe 34 PID 792 wrote to memory of 1492 792 cmd.exe 34 PID 1572 wrote to memory of 1652 1572 PING32.exe 35 PID 1572 wrote to memory of 1652 1572 PING32.exe 35 PID 1572 wrote to memory of 1652 1572 PING32.exe 35 PID 1248 wrote to memory of 988 1248 taskeng.exe 39 PID 1248 wrote to memory of 988 1248 taskeng.exe 39 PID 1248 wrote to memory of 988 1248 taskeng.exe 39 PID 1248 wrote to memory of 1524 1248 taskeng.exe 41 PID 1248 wrote to memory of 1524 1248 taskeng.exe 41 PID 1248 wrote to memory of 1524 1248 taskeng.exe 41 PID 1248 wrote to memory of 1660 1248 taskeng.exe 42 PID 1248 wrote to memory of 1660 1248 taskeng.exe 42 PID 1248 wrote to memory of 1660 1248 taskeng.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe"C:\Users\Admin\AppData\Local\Temp\8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1916 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PING32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PING32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1572 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PING32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:1652
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1624
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe" && del "C:\Users\Admin\AppData\Local\Temp\8e5b0427bc2c06b0e6faaa6fca1e9f13b391a0e6d2c7d888050040317f6b0a5e.exe.config"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:792 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1492
-
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {4FB3179B-356E-46C8-9F2B-09EB34D2118B} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1248 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PING32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PING32.exe arguments2⤵
- Executes dropped EXE
PID:988
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PING32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PING32.exe arguments2⤵
- Executes dropped EXE
PID:1524
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PING32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\PING32.exe arguments2⤵
- Executes dropped EXE
PID:1660
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1040