Analysis
- max time kernel
145s - max time network
143s - platform
windows7_x64 - resource
win7v20201028 - submitted
15/11/2020, 23:20
Static task
static1
Behavioral task
behavioral1
Sample
da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe
- Size 221KB
- Sample201115-egha5fmy5e
- SHA256 da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d
- MD5 df0a7d366ea72ef1f30103a7aba59cff
- SHA1 97080d4d952e53ec4100d6f514afe2ce4c37bafa
- SHA512 aa1070c1e9e4396eea2acd6fcf9775d32796127c497cb8924f1cf855c03788f2fd5128fb233716aa2ea874033d8a40674ce54d3a7e7f543130567973e86711bd
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\shell = "explorer.exe, C:\\Users\\Admin\\AppData\\Local\\_foldernamelocalappdata_\\WUDFHost32.exe" WUDFHost32.exe - Executes dropped EXE 3 IoCs
pid Process 1120 WUDFHost32.exe 816 WUDFHost32.exe 996 WUDFHost32.exe - Deletes itself 1 IoCs
pid Process 820 cmd.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\*WUDFHost32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe" da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\WUDFHost32 = "C:\\Users\\Admin\\AppData\\Local\\Temp\\da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe" da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe - Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Modifies service 2 TTPs 28 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking 4.0.0.0\Linkage WUDFHost32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200034002e0030002e0030002e00300000000000 WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for Oracle\Linkage WUDFHost32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage\Export = 4d0053004400540043002000420072006900640067006500200033002e0030002e0030002e00300000000000 WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage WUDFHost32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200033002e0030002e0030002e00300000000000 WUDFHost32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\Disable Performance Counters = "4" WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 3.0.0.0\Linkage WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Data Provider for SqlServer\Linkage WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage WUDFHost32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET Memory Cache 4.0\Linkage\Export = 2e004e004500540020004d0065006d006f0072007900200043006100630068006500200034002e00300000000000 WUDFHost32.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Outlook\Performance\1021 = "132499654413174512" WUDFHost32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200033002e0030002e0030002e00300000000000 WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 3.0.0.0\Linkage WUDFHost32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage\Export = 570069006e0064006f0077007300200057006f0072006b0066006c006f007700200046006f0075006e0064006100740069006f006e00200034002e0030002e0030002e00300000000000 WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\BITS\Performance WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 4.0.0.0\Linkage WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Data\Linkage WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\.NET CLR Networking\Linkage WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MSDTC Bridge 4.0.0.0\Linkage WUDFHost32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c0045006e00640070006f0069006e007400200033002e0030002e0030002e00300000000000 WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage WUDFHost32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SMSvcHost 4.0.0.0\Linkage\Export = 53004d0053007600630048006f0073007400200034002e0030002e0030002e00300000000000 WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Windows Workflow Foundation 3.0.0.0\Linkage WUDFHost32.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelEndpoint 3.0.0.0\Linkage WUDFHost32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelOperation 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c004f007000650072006100740069006f006e00200033002e0030002e0030002e00300000000000 WUDFHost32.exe Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\ServiceModelService 3.0.0.0\Linkage\Export = 53006500720076006900630065004d006f00640065006c005300650072007600690063006500200033002e0030002e0030002e00300000000000 WUDFHost32.exe - Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
pid Process 1648 schtasks.exe - Delays execution with timeout.exe 1 IoCs
pid Process 564 timeout.exe - Suspicious behavior: EnumeratesProcesses 65 IoCs
pid Process 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe 1120 WUDFHost32.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1120 WUDFHost32.exe - Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 364 wrote to memory of 1120 364 da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe 29 PID 364 wrote to memory of 1120 364 da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe 29 PID 364 wrote to memory of 1120 364 da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe 29 PID 364 wrote to memory of 1352 364 da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe 30 PID 364 wrote to memory of 1352 364 da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe 30 PID 364 wrote to memory of 1352 364 da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe 30 PID 364 wrote to memory of 820 364 da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe 31 PID 364 wrote to memory of 820 364 da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe 31 PID 364 wrote to memory of 820 364 da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe 31 PID 820 wrote to memory of 564 820 cmd.exe 34 PID 820 wrote to memory of 564 820 cmd.exe 34 PID 820 wrote to memory of 564 820 cmd.exe 34 PID 1120 wrote to memory of 1648 1120 WUDFHost32.exe 35 PID 1120 wrote to memory of 1648 1120 WUDFHost32.exe 35 PID 1120 wrote to memory of 1648 1120 WUDFHost32.exe 35 PID 328 wrote to memory of 816 328 taskeng.exe 40 PID 328 wrote to memory of 816 328 taskeng.exe 40 PID 328 wrote to memory of 816 328 taskeng.exe 40 PID 328 wrote to memory of 996 328 taskeng.exe 41 PID 328 wrote to memory of 996 328 taskeng.exe 41 PID 328 wrote to memory of 996 328 taskeng.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe"C:\Users\Admin\AppData\Local\Temp\da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\WUDFHost32.exe"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\WUDFHost32.exe"2⤵
- Modifies WinLogon for persistence
- Executes dropped EXE
- Modifies service
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1120 -
C:\Windows\System32\schtasks.exe"C:\Windows\System32\schtasks.exe" /create /tn Admin /tr "\"C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\WUDFHost32.exe\" arguments" /sc MINUTE /mo 13⤵
- Creates scheduled task(s)
PID:1648
-
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe"2⤵PID:1352
-
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout /t 5 && del "C:\Users\Admin\AppData\Local\Temp\da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe" && del "C:\Users\Admin\AppData\Local\Temp\da77c22aa40d46a98b836ff2e92c62f41c848f2ca989890ac190ca8feea8433d.exe.config"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
PID:820 -
C:\Windows\system32\timeout.exetimeout /t 53⤵
- Delays execution with timeout.exe
PID:564
-
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:340
-
C:\Windows\system32\taskeng.exetaskeng.exe {2315976F-1DD2-4A39-A7BC-11B383B3F62F} S-1-5-21-293278959-2699126792-324916226-1000:TUICJFPF\Admin:Interactive:[1]1⤵
- Suspicious use of WriteProcessMemory
PID:328 -
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\WUDFHost32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\WUDFHost32.exe arguments2⤵
- Executes dropped EXE
PID:816
-
-
C:\Users\Admin\AppData\Local\_foldernamelocalappdata_\WUDFHost32.exeC:\Users\Admin\AppData\Local\_foldernamelocalappdata_\WUDFHost32.exe arguments2⤵
- Executes dropped EXE
PID:996
-