Analysis
- max time kernel
145s - max time network
149s - platform
windows7_x64 - resource
win7v20201028 - submitted
11/11/2020, 11:02
Static task
static1
Behavioral task
behavioral1
Sample
0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe
- Size 221KB
- Sample201111-dhlgh61fen
- SHA256 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8
- MD5 4d76895d5865e446fdacb24b289b812e
- SHA1 463528862b5fa009c554fe75d9ea2c359a99d217
- SHA512 a0472aa7336230c55ff5c9462412a0ce65ea92125106afd39d994b0596a34da8641ead94311bee71bf6ffb2c2d5ac3cd6e14e5779a89e2e9108fb842b90d9885
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\wkssvc32.exe" wkssvc32.exe - Executes dropped EXE 4 IoCs
pid Process 1988 wkssvc32.exe 1968 wkssvc32.exe 1784 wkssvc32.exe 436 wkssvc32.exe - Deletes itself 1 IoCs
pid Process 1784 cmd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*wkssvc32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe" 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\wkssvc32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe" 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage wkssvc32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1021 = "132495680905910512" wkssvc32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 wkssvc32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 wkssvc32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage wkssvc32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage wkssvc32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage wkssvc32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 wkssvc32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 wkssvc32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage wkssvc32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "4" wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage wkssvc32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage wkssvc32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage wkssvc32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 wkssvc32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1532 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1764 timeout.exe - Suspicious behavior: EnumeratesProcesses 68 IoCs
pid Process 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe 1988 wkssvc32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1988 wkssvc32.exe - Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1904 wrote to memory of 1988 1904 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe 26 PID 1904 wrote to memory of 1988 1904 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe 26 PID 1904 wrote to memory of 1988 1904 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe 26 PID 1904 wrote to memory of 1688 1904 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe 27 PID 1904 wrote to memory of 1688 1904 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe 27 PID 1904 wrote to memory of 1688 1904 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe 27 PID 1904 wrote to memory of 1784 1904 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe 29 PID 1904 wrote to memory of 1784 1904 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe 29 PID 1904 wrote to memory of 1784 1904 0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe 29 PID 1784 wrote to memory of 1764 1784 cmd.exe 31 PID 1784 wrote to memory of 1764 1784 cmd.exe 31 PID 1784 wrote to memory of 1764 1784 cmd.exe 31 PID 1988 wrote to memory of 1532 1988 wkssvc32.exe 35 PID 1988 wrote to memory of 1532 1988 wkssvc32.exe 35 PID 1988 wrote to memory of 1532 1988 wkssvc32.exe 35 PID 1616 wrote to memory of 1968 1616 taskeng.exe 40 PID 1616 wrote to memory of 1968 1616 taskeng.exe 40 PID 1616 wrote to memory of 1968 1616 taskeng.exe 40 PID 1616 wrote to memory of 1784 1616 taskeng.exe 41 PID 1616 wrote to memory of 1784 1616 taskeng.exe 41 PID 1616 wrote to memory of 1784 1616 taskeng.exe 41 PID 1616 wrote to memory of 436 1616 taskeng.exe 42 PID 1616 wrote to memory of 436 1616 taskeng.exe 42 PID 1616 wrote to memory of 436 1616 taskeng.exe 42
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe"C:\Users\Admin\AppData\Local\Temp\0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1904 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\wkssvc32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\wkssvc32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1988 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\wkssvc32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:1532
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1688
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe" && del "C:\Users\Admin\AppData\Local\Temp\0ef2c247f4f84c13faec72e1f66af9d195a882d5b9393e38cb7240aa5cb2fdf8.exe.config"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1764
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:676
-
C:\Windows\system32\taskeng.exetaskeng.exe {74D62CDD-454C-4513-A814-5F306A3A28BB} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\wkssvc32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\wkssvc32.exe arguments2⤵
- Executes dropped EXE
PID:1968
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\wkssvc32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\wkssvc32.exe arguments2⤵
- Executes dropped EXE
PID:1784
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\wkssvc32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\wkssvc32.exe arguments2⤵
- Executes dropped EXE
PID:436
-