Analysis
- max time kernel
144s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
14/11/2020, 18:12
Static task
static1
Behavioral task
behavioral1
Sample
f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe
- Size 222KB
- Sample201114-ef1thvth72
- SHA256 f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e
- MD5 1b5a4e8b3bce113175087ee1cb55233c
- SHA1 ff77c78f1cd4c061403c7dfa19666cb8080aa573
- SHA512 b1c180c1a95c0c93f1f38310d7d710a2c4f54443885e2b317df130af9b3cfaa9da47c9ce4db897b9e552e65853d4c3fd9d751309401cedf3ed096cdb02db696e
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\CoreMmRes32.exe" CoreMmRes32.exe - Executes dropped EXE 3 IoCs
pid Process 3168 CoreMmRes32.exe 3716 CoreMmRes32.exe 3328 CoreMmRes32.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\CoreMmRes32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe" f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 26 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for Oracle\Linkage CoreMmRes32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Data\Linkage CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking\Linkage CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage CoreMmRes32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage CoreMmRes32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 CoreMmRes32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 4.0.0.0\Linkage CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage CoreMmRes32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET CLR Networking 4.0.0.0\Linkage CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage CoreMmRes32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SMSvcHost 3.0.0.0\Linkage CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage CoreMmRes32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Data Provider for SqlServer\Linkage CoreMmRes32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 CoreMmRes32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 CoreMmRes32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 CoreMmRes32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\ServiceModelService 3.0.0.0\Linkage CoreMmRes32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 4080 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 208 timeout.exe - Suspicious behavior: EnumeratesProcesses 96 IoCs
pid Process 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe 3168 CoreMmRes32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 3168 CoreMmRes32.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2484 wrote to memory of 3168 2484 f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe 75 PID 2484 wrote to memory of 3168 2484 f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe 75 PID 2484 wrote to memory of 408 2484 f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe 76 PID 2484 wrote to memory of 408 2484 f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe 76 PID 2484 wrote to memory of 3080 2484 f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe 77 PID 2484 wrote to memory of 3080 2484 f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe 77 PID 3080 wrote to memory of 208 3080 cmd.exe 80 PID 3080 wrote to memory of 208 3080 cmd.exe 80 PID 3168 wrote to memory of 4080 3168 CoreMmRes32.exe 83 PID 3168 wrote to memory of 4080 3168 CoreMmRes32.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe"C:\Users\Admin\AppData\Local\Temp\f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2484 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\CoreMmRes32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\CoreMmRes32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3168 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\CoreMmRes32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:4080
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:408
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe" && del "C:\Users\Admin\AppData\Local\Temp\f62de9cf7e53e790f80a6101fd93d941e147e43f8b9422d88a51b6213cd62c8e.exe.config"2⤵
- Suspicious use of WriteProcessMemory
PID:3080 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:208
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:2816
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\CoreMmRes32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\CoreMmRes32.exe arguments1⤵
- Executes dropped EXE
PID:3716
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\CoreMmRes32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\CoreMmRes32.exe arguments1⤵
- Executes dropped EXE
PID:3328