Analysis
- max time kernel
147s - max time network
146s - platform
windows7_x64 - resource
win7v20201028 - submitted
13/11/2020, 15:54
Static task
static1
Behavioral task
behavioral1
Sample
cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe
- Size 221KB
- Sample201113-axe1m1f3an
- SHA256 cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b
- MD5 0dab42a92fda93c87cda1df288978bb9
- SHA1 16471f1c2cd7788b648819fc890e3a5d7a26d98e
- SHA512 4c268ec28654d1fef43fb0ffe1bf43ddd2721c1ddcb66a5449938a2b7e28efe4f1ca7e4009331538b380273ffadc125c49f017d8278888cfe46082725834c45d
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\autofmt32.exe" autofmt32.exe - Executes dropped EXE 3 IoCs
pid Process 1340 autofmt32.exe 1376 autofmt32.exe 784 autofmt32.exe - Deletes itself 1 IoCs
pid Process 652 cmd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*autofmt32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe" cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\autofmt32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe" cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage autofmt32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "4" autofmt32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage autofmt32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage autofmt32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage autofmt32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage autofmt32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 autofmt32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1021 = "132497708293834512" autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage autofmt32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage autofmt32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage autofmt32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 autofmt32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage autofmt32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 autofmt32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage autofmt32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 400 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 1560 timeout.exe - Suspicious behavior: EnumeratesProcesses 63 IoCs
pid Process 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe 1340 autofmt32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1340 autofmt32.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1744 wrote to memory of 1340 1744 cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe 29 PID 1744 wrote to memory of 1340 1744 cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe 29 PID 1744 wrote to memory of 1340 1744 cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe 29 PID 1744 wrote to memory of 1336 1744 cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe 30 PID 1744 wrote to memory of 1336 1744 cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe 30 PID 1744 wrote to memory of 1336 1744 cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe 30 PID 1744 wrote to memory of 652 1744 cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe 31 PID 1744 wrote to memory of 652 1744 cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe 31 PID 1744 wrote to memory of 652 1744 cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe 31 PID 652 wrote to memory of 1560 652 cmd.exe 34 PID 652 wrote to memory of 1560 652 cmd.exe 34 PID 652 wrote to memory of 1560 652 cmd.exe 34 PID 1340 wrote to memory of 400 1340 autofmt32.exe 35 PID 1340 wrote to memory of 400 1340 autofmt32.exe 35 PID 1340 wrote to memory of 400 1340 autofmt32.exe 35 PID 1700 wrote to memory of 1376 1700 taskeng.exe 40 PID 1700 wrote to memory of 1376 1700 taskeng.exe 40 PID 1700 wrote to memory of 1376 1700 taskeng.exe 40 PID 1700 wrote to memory of 784 1700 taskeng.exe 41 PID 1700 wrote to memory of 784 1700 taskeng.exe 41 PID 1700 wrote to memory of 784 1700 taskeng.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe"C:\Users\Admin\AppData\Local\Temp\cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\autofmt32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\autofmt32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\autofmt32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:400
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1336
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe" && del "C:\Users\Admin\AppData\Local\Temp\cdf3c63a92c375d97abefdb7599d8a70f126108e4ad662105ce86bc984e4a71b.exe.config"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:652 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:1560
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:868
-
C:\Windows\system32\taskeng.exetaskeng.exe {054B4F6F-310A-409A-BAB2-E05EC015CD98} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1700 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\autofmt32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\autofmt32.exe arguments2⤵
- Executes dropped EXE
PID:1376
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\autofmt32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\autofmt32.exe arguments2⤵
- Executes dropped EXE
PID:784
-