Analysis
- max time kernel
144s - max time network
148s - platform
windows7_x64 - resource
win7v20201028 - submitted
12/11/2020, 14:05
Static task
static1
Behavioral task
behavioral1
Sample
96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe
- Size 221KB
- Sample201112-blf5m8d6sa
- SHA256 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6
- MD5 432d82601dd6b3784caf6a1f2046b68e
- SHA1 a8dda9eac952e24ad39c062ed7384ca5ec1962a0
- SHA512 89c0acbf859c8c28841d7249bfa2379876d4c75c455c0925ee15e89d0588f383f19a2942bfcbfdc10d8c59d3a06afdbcbd52e4337bfd02f9c7251dafbe45fed8
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\localui32.exe" localui32.exe - Executes dropped EXE 3 IoCs
pid Process 1316 localui32.exe 1516 localui32.exe 1636 localui32.exe - Deletes itself 1 IoCs
pid Process 920 cmd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*localui32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe" 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\localui32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe" 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 28 IoCs
description ioc Process Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage localui32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage localui32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage localui32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 localui32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 localui32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage localui32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage localui32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage localui32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage localui32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage localui32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage localui32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1021 = "132496657009716512" localui32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "4" localui32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 528 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 884 timeout.exe - Suspicious behavior: EnumeratesProcesses 68 IoCs
pid Process 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe 1316 localui32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1316 localui32.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 344 wrote to memory of 1316 344 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe 29 PID 344 wrote to memory of 1316 344 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe 29 PID 344 wrote to memory of 1316 344 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe 29 PID 344 wrote to memory of 1248 344 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe 30 PID 344 wrote to memory of 1248 344 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe 30 PID 344 wrote to memory of 1248 344 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe 30 PID 344 wrote to memory of 920 344 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe 32 PID 344 wrote to memory of 920 344 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe 32 PID 344 wrote to memory of 920 344 96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe 32 PID 920 wrote to memory of 884 920 cmd.exe 34 PID 920 wrote to memory of 884 920 cmd.exe 34 PID 920 wrote to memory of 884 920 cmd.exe 34 PID 1316 wrote to memory of 528 1316 localui32.exe 35 PID 1316 wrote to memory of 528 1316 localui32.exe 35 PID 1316 wrote to memory of 528 1316 localui32.exe 35 PID 1152 wrote to memory of 1516 1152 taskeng.exe 40 PID 1152 wrote to memory of 1516 1152 taskeng.exe 40 PID 1152 wrote to memory of 1516 1152 taskeng.exe 40 PID 1152 wrote to memory of 1636 1152 taskeng.exe 41 PID 1152 wrote to memory of 1636 1152 taskeng.exe 41 PID 1152 wrote to memory of 1636 1152 taskeng.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe"C:\Users\Admin\AppData\Local\Temp\96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:344 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\localui32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\localui32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\localui32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:528
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1248
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe" && del "C:\Users\Admin\AppData\Local\Temp\96c74934f5dfb4c055192ed0f8be284bfd3d1cb1f00e56e4d50b5e2eca176be6.exe.config"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:920 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:884
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:924
-
C:\Windows\system32\taskeng.exetaskeng.exe {8C3F9068-C378-4476-BBD7-A6BCE48AD994} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1152 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\localui32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\localui32.exe arguments2⤵
- Executes dropped EXE
PID:1516
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\localui32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\localui32.exe arguments2⤵
- Executes dropped EXE
PID:1636
-