Analysis
-
max time kernel
143s -
max time network
151s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
27-11-2020 14:41
Static task
static1
Behavioral task
behavioral1
Sample
1_3@1.exe
Resource
win7v20201028
General
-
Target
1_3@1.exe
-
Size
143KB
-
MD5
b034e2a7cd76b757b7c62ce514b378b4
-
SHA1
27d15f36cb5e3338a19a7f6441ece58439f830f2
-
SHA256
90d3580e187b631a9150bbb4a640b84c6fa990437febdc42f687cc7b3ce1deac
-
SHA512
1cea6503cf244e1efb6ef68994a723f549126fc89ef8a38c76cdcc050d2a4524e96402591d1d150d927a12dcac81084a8275a929cf6e5933fdf62502c9c84385
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
wcfgmgr32.exepid process 1780 wcfgmgr32.exe -
Processes:
resource yara_rule \Windows\3049586940303040\wcfgmgr32.exe upx \Windows\3049586940303040\wcfgmgr32.exe upx C:\Windows\3049586940303040\wcfgmgr32.exe upx -
Loads dropped DLL 2 IoCs
Processes:
1_3@1.exepid process 1684 1_3@1.exe 1684 1_3@1.exe -
Processes:
wcfgmgr32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wcfgmgr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1_3@1.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\WCfgMgr32 = "C:\\Windows\\3049586940303040\\wcfgmgr32.exe" 1_3@1.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\WCfgMgr32 = "C:\\Windows\\3049586940303040\\wcfgmgr32.exe" 1_3@1.exe -
Drops file in Windows directory 3 IoCs
Processes:
1_3@1.exedescription ioc process File created C:\Windows\3049586940303040\wcfgmgr32.exe 1_3@1.exe File opened for modification C:\Windows\3049586940303040\wcfgmgr32.exe 1_3@1.exe File opened for modification C:\Windows\3049586940303040 1_3@1.exe -
Suspicious use of WriteProcessMemory 4 IoCs
Processes:
1_3@1.exedescription pid process target process PID 1684 wrote to memory of 1780 1684 1_3@1.exe wcfgmgr32.exe PID 1684 wrote to memory of 1780 1684 1_3@1.exe wcfgmgr32.exe PID 1684 wrote to memory of 1780 1684 1_3@1.exe wcfgmgr32.exe PID 1684 wrote to memory of 1780 1684 1_3@1.exe wcfgmgr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1_3@1.exe"C:\Users\Admin\AppData\Local\Temp\1_3@1.exe"1⤵
- Loads dropped DLL
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\3049586940303040\wcfgmgr32.exeC:\Windows\3049586940303040\wcfgmgr32.exe2⤵
- Executes dropped EXE
- Windows security modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\3049586940303040\wcfgmgr32.exeMD5
b034e2a7cd76b757b7c62ce514b378b4
SHA127d15f36cb5e3338a19a7f6441ece58439f830f2
SHA25690d3580e187b631a9150bbb4a640b84c6fa990437febdc42f687cc7b3ce1deac
SHA5121cea6503cf244e1efb6ef68994a723f549126fc89ef8a38c76cdcc050d2a4524e96402591d1d150d927a12dcac81084a8275a929cf6e5933fdf62502c9c84385
-
\Windows\3049586940303040\wcfgmgr32.exeMD5
b034e2a7cd76b757b7c62ce514b378b4
SHA127d15f36cb5e3338a19a7f6441ece58439f830f2
SHA25690d3580e187b631a9150bbb4a640b84c6fa990437febdc42f687cc7b3ce1deac
SHA5121cea6503cf244e1efb6ef68994a723f549126fc89ef8a38c76cdcc050d2a4524e96402591d1d150d927a12dcac81084a8275a929cf6e5933fdf62502c9c84385
-
\Windows\3049586940303040\wcfgmgr32.exeMD5
b034e2a7cd76b757b7c62ce514b378b4
SHA127d15f36cb5e3338a19a7f6441ece58439f830f2
SHA25690d3580e187b631a9150bbb4a640b84c6fa990437febdc42f687cc7b3ce1deac
SHA5121cea6503cf244e1efb6ef68994a723f549126fc89ef8a38c76cdcc050d2a4524e96402591d1d150d927a12dcac81084a8275a929cf6e5933fdf62502c9c84385
-
memory/1036-8-0x000007FEF7080000-0x000007FEF72FA000-memory.dmpFilesize
2.5MB
-
memory/1684-2-0x0000000003172000-0x0000000003176000-memory.dmpFilesize
16KB
-
memory/1780-5-0x0000000000000000-mapping.dmp
-
memory/1780-7-0x0000000002ED2000-0x0000000002ED6000-memory.dmpFilesize
16KB