Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 15:20
Static task
static1
Behavioral task
behavioral1
Sample
aa02188daab3faaaba74081d7e9a4986.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
aa02188daab3faaaba74081d7e9a4986.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
aa02188daab3faaaba74081d7e9a4986.exe
-
Size
184KB
-
MD5
f59deb960309edee8ff6eee523f52006
-
SHA1
933ab0fec556e4cd02d7971ec7fc0a3f1c000b8a
-
SHA256
d7754476cbf09c62d377387cc0cea85bdad171cec82388f4ab2e2accf1d1f876
-
SHA512
ff5ff71b5e47800429e77df9a491300bc282f4fec0133151e72611969257eb553e2c5441c7faec8b22a67d7c645ea5ca4c87f73c73b236cca8bf910cc6526f5d
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\6502DC56 = "C:\\Users\\Admin\\AppData\\Roaming\\6502DC56\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1780 winver.exe 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1892 wrote to memory of 1780 1892 aa02188daab3faaaba74081d7e9a4986.exe 29 PID 1892 wrote to memory of 1780 1892 aa02188daab3faaaba74081d7e9a4986.exe 29 PID 1892 wrote to memory of 1780 1892 aa02188daab3faaaba74081d7e9a4986.exe 29 PID 1892 wrote to memory of 1780 1892 aa02188daab3faaaba74081d7e9a4986.exe 29 PID 1892 wrote to memory of 1780 1892 aa02188daab3faaaba74081d7e9a4986.exe 29 PID 1780 wrote to memory of 1268 1780 winver.exe 21 PID 1780 wrote to memory of 1128 1780 winver.exe 19 PID 1780 wrote to memory of 1228 1780 winver.exe 20 PID 1780 wrote to memory of 1268 1780 winver.exe 21
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1228
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\aa02188daab3faaaba74081d7e9a4986.exe"C:\Users\Admin\AppData\Local\Temp\aa02188daab3faaaba74081d7e9a4986.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1892 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1780
-
-