Analysis
- max time kernel
150s - max time network
139s - platform
windows7_x64 - resource
win7v20201028 - submitted
13/11/2020, 16:21
Static task
static1
Behavioral task
behavioral1
Sample
1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe
- Size 1.1MB
- Sample201113-pv2pnrd672
- SHA256 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d
- MD5 127e557edb60a0ccd6644eda3ef790af
- SHA1 9afbcab2f30bdd7973e1c3ac06496337723a808f
- SHA512 7ee3264b5e1dda2e233d256252a0e37f2f5fd72c10b72b38532c0dafb63975120c45341ddc1e66516c12d52ad23c633cad4805b3c8e50d4baa1a18572eb9bb80
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 524 data.exe - Modifies Windows Firewall 1 TTPs
- Modifies service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\LocalConfig netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\Enroll\HcsGroups netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Shas netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\NapAgent\Qecs netsh.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\napagent\LocalConfig\UI netsh.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 836 set thread context of 924 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 29 - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1408 schtasks.exe - Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeDebugPrivilege 924 RegAsm.exe Token: 33 924 RegAsm.exe Token: SeIncBasePriorityPrivilege 924 RegAsm.exe Token: 33 924 RegAsm.exe Token: SeIncBasePriorityPrivilege 924 RegAsm.exe Token: 33 924 RegAsm.exe Token: SeIncBasePriorityPrivilege 924 RegAsm.exe Token: 33 924 RegAsm.exe Token: SeIncBasePriorityPrivilege 924 RegAsm.exe Token: 33 924 RegAsm.exe Token: SeIncBasePriorityPrivilege 924 RegAsm.exe Token: 33 924 RegAsm.exe Token: SeIncBasePriorityPrivilege 924 RegAsm.exe Token: 33 924 RegAsm.exe Token: SeIncBasePriorityPrivilege 924 RegAsm.exe Token: 33 924 RegAsm.exe Token: SeIncBasePriorityPrivilege 924 RegAsm.exe Token: 33 924 RegAsm.exe Token: SeIncBasePriorityPrivilege 924 RegAsm.exe Token: 33 924 RegAsm.exe Token: SeIncBasePriorityPrivilege 924 RegAsm.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 836 wrote to memory of 924 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 29 PID 836 wrote to memory of 924 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 29 PID 836 wrote to memory of 924 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 29 PID 836 wrote to memory of 924 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 29 PID 836 wrote to memory of 924 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 29 PID 836 wrote to memory of 924 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 29 PID 836 wrote to memory of 924 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 29 PID 836 wrote to memory of 924 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 29 PID 836 wrote to memory of 924 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 29 PID 836 wrote to memory of 1408 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 30 PID 836 wrote to memory of 1408 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 30 PID 836 wrote to memory of 1408 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 30 PID 836 wrote to memory of 1408 836 1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe 30 PID 924 wrote to memory of 1696 924 RegAsm.exe 32 PID 924 wrote to memory of 1696 924 RegAsm.exe 32 PID 924 wrote to memory of 1696 924 RegAsm.exe 32 PID 924 wrote to memory of 1696 924 RegAsm.exe 32 PID 1532 wrote to memory of 524 1532 taskeng.exe 35 PID 1532 wrote to memory of 524 1532 taskeng.exe 35 PID 1532 wrote to memory of 524 1532 taskeng.exe 35 PID 1532 wrote to memory of 524 1532 taskeng.exe 35
Processes
-
C:\Users\Admin\AppData\Local\Temp\1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe"C:\Users\Admin\AppData\Local\Temp\1ecde0b85ddc9e37bdc3004b732f73d2dd12f0e101f91ebda16cbbf30ddd4a9d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:836 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:924 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Windows\Microsoft.NET\Framework\v2.0.50727\RegAsm.exe" "RegAsm.exe" ENABLE3⤵
- Modifies service
PID:1696
-
-
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\SysWOW64\schtasks.exe" /create /tn backgroundTaskHost /tr "C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe" /sc minute /mo 1 /F2⤵
- Creates scheduled task(s)
PID:1408
-
-
C:\Windows\system32\taskeng.exetaskeng.exe {0E957DEC-4EC3-4A58-88AE-C52B8AF5C348} S-1-5-21-3825035466-2522850611-591511364-1000:EIDQHRRL\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:1532 -
C:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exeC:\Users\Admin\AppData\Local\Temp\RdpSaUacHelper\data.exe2⤵
- Executes dropped EXE
PID:524
-