Analysis
- max time kernel
141s - max time network
149s - platform
windows10_x64 - resource
win10v20201028 - submitted
14/11/2020, 18:15
Static task
static1
Behavioral task
behavioral1
Sample
996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe
- Size 222KB
- Sample201114-eddd168j2s
- SHA256 996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b
- MD5 399cdf84bac2a886200f693793df2f42
- SHA1 eb4c8e75abc65c9bc29499eab5afd5843fcc00b7
- SHA512 6b3791b98dd3d6dbefa21a7b2de8a82266124e5e5ec1ca637153dcc35476e9719fa4a9a4047d1ea844a0d1262a92a2e61b76740f95dc25b8277495ea6b113dfb
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\umpoext32.exe" umpoext32.exe - Executes dropped EXE 3 IoCs
pid Process 4068 umpoext32.exe 2592 umpoext32.exe 3200 umpoext32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\umpoext32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe" 996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Data\Linkage umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking\Linkage umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking 4.0.0.0\Linkage umpoext32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage umpoext32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage umpoext32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 umpoext32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 umpoext32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 umpoext32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage umpoext32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage umpoext32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage umpoext32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for Oracle\Linkage umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for SqlServer\Linkage umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage umpoext32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage umpoext32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance umpoext32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 2356 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 2756 timeout.exe - Suspicious behavior: EnumeratesProcesses 98 IoCs
pid Process 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe 4068 umpoext32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 4068 umpoext32.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 3372 wrote to memory of 4068 3372 996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe 75 PID 3372 wrote to memory of 4068 3372 996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe 75 PID 3372 wrote to memory of 188 3372 996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe 76 PID 3372 wrote to memory of 188 3372 996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe 76 PID 3372 wrote to memory of 940 3372 996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe 77 PID 3372 wrote to memory of 940 3372 996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe 77 PID 940 wrote to memory of 2756 940 cmd.exe 80 PID 940 wrote to memory of 2756 940 cmd.exe 80 PID 4068 wrote to memory of 2356 4068 umpoext32.exe 81 PID 4068 wrote to memory of 2356 4068 umpoext32.exe 81
Processes
-
C:\Users\Admin\AppData\Local\Temp\996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe"C:\Users\Admin\AppData\Local\Temp\996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:3372 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umpoext32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umpoext32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4068 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umpoext32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:2356
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:188
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe" && del "C:\Users\Admin\AppData\Local\Temp\996fb97f3d1725822ab85fa396ca26d30ca07636a7b344eba3cf48bcec16933b.exe.config"2⤵
- Suspicious use of WriteProcessMemory
PID:940 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:2756
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:3552
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umpoext32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umpoext32.exe arguments1⤵
- Executes dropped EXE
PID:2592
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umpoext32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\umpoext32.exe arguments1⤵
- Executes dropped EXE
PID:3200