Analysis
- max time kernel
150s - max time network
110s - platform
windows10_x64 - resource
win10v20201028 - submitted
27/11/2020, 07:45
Static task
static1
Behavioral task
behavioral1
Sample
1.bin.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1.bin.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target 1.bin.exe
- Size 142KB
- Sample201127-ljae7d59hs
- SHA256 33832e553779ef5339b82429a8db556b1e4f458406fd5c7d90b005deb4e68f28
- MD5 7c59fde9b70378548091eecbe4865bd4
- SHA1 5dbc811e8d8f6a8603ed0661856f6713c1f88311
- SHA512 83092f14815c2cad54aea0c724edb942e3771f08d2914901453b64cbf29ad0d8c84587ef76cd350bacff67757a6d60ee2df4e7ac8a8819170b23b557a913eb61
- MD5 SHA1 SHA512
Score
10/10
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "empty" 1.bin.exe - Disables Task Manager via registry modification
- Drops desktop.ini file(s) 1 IoCs
description ioc Process File created C:\Users\Admin\Downloads\desktop.ini 1.bin.exe - Sets desktop wallpaper using registry 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Control Panel\Desktop\Wallpaper 1.bin.exe - Suspicious behavior: EnumeratesProcesses 463 IoCs
pid Process 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2260 1.bin.exe - Suspicious use of FindShellTrayWindow 20 IoCs
pid Process 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe 2260 1.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1.bin.exe"C:\Users\Admin\AppData\Local\Temp\1.bin.exe"1⤵
- Modifies WinLogon for persistence
- Drops desktop.ini file(s)
- Sets desktop wallpaper using registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
PID:2260