Analysis
-
max time kernel
150s -
max time network
111s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
14-12-2020 14:05
Static task
static1
Behavioral task
behavioral1
Sample
29654ccad81119626310530ede0ad5f4.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
29654ccad81119626310530ede0ad5f4.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
29654ccad81119626310530ede0ad5f4.exe
-
Size
31KB
-
MD5
29654ccad81119626310530ede0ad5f4
-
SHA1
eb16c8d1321d1f855aa010c5afca21a40c4973a6
-
SHA256
19788561d057a67c409c9ea98e5168894ee33eb1da0255cafd34fe971aa93b8e
-
SHA512
8c8e7931591b767678bd0e63d64a78d60813e6d7951212828e6f372534df26fe46910a5ccc504fa4c64273daa8266456d1c980514c1acb7d1aa1aeb1b81e637b
Score
10/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
29654ccad81119626310530ede0ad5f4.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2a2b006d9fab3cab17335fac8d9a558d.exe 29654ccad81119626310530ede0ad5f4.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\2a2b006d9fab3cab17335fac8d9a558d.exe 29654ccad81119626310530ede0ad5f4.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
29654ccad81119626310530ede0ad5f4.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\2a2b006d9fab3cab17335fac8d9a558d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\29654ccad81119626310530ede0ad5f4.exe\" .." 29654ccad81119626310530ede0ad5f4.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\2a2b006d9fab3cab17335fac8d9a558d = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\29654ccad81119626310530ede0ad5f4.exe\" .." 29654ccad81119626310530ede0ad5f4.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
29654ccad81119626310530ede0ad5f4.exepid process 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe 3992 29654ccad81119626310530ede0ad5f4.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
29654ccad81119626310530ede0ad5f4.exedescription pid process Token: SeDebugPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe Token: 33 3992 29654ccad81119626310530ede0ad5f4.exe Token: SeIncBasePriorityPrivilege 3992 29654ccad81119626310530ede0ad5f4.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
29654ccad81119626310530ede0ad5f4.exedescription pid process target process PID 3992 wrote to memory of 1092 3992 29654ccad81119626310530ede0ad5f4.exe netsh.exe PID 3992 wrote to memory of 1092 3992 29654ccad81119626310530ede0ad5f4.exe netsh.exe PID 3992 wrote to memory of 1092 3992 29654ccad81119626310530ede0ad5f4.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\29654ccad81119626310530ede0ad5f4.exe"C:\Users\Admin\AppData\Local\Temp\29654ccad81119626310530ede0ad5f4.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\29654ccad81119626310530ede0ad5f4.exe" "29654ccad81119626310530ede0ad5f4.exe" ENABLE2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1092-2-0x0000000000000000-mapping.dmp