Analysis
- max time kernel
146s - max time network
145s - platform
windows10_x64 - resource
win10v20201028 - submitted
08/01/2021, 07:07
Static task
static1
Behavioral task
behavioral1
Sample
df19cccb4855faee7eb6a933b487cdf4.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
df19cccb4855faee7eb6a933b487cdf4.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
- Target df19cccb4855faee7eb6a933b487cdf4.exe
- Size 3.7MB
- Sample210108-36n89epqae
- SHA256 78e948358f9dee4cedfadeda96958f295d04abf52ab475c381a4f312044a5398
- MD5 df19cccb4855faee7eb6a933b487cdf4
- SHA1 65c08dcea9c7fc3dcf2da6abfed1f0b5a8a05da8
- SHA512 836f650fe68301f3da8eb96044df02e03f9e435174c2b43203fb12fb602d5fa01a4185a89bb436b9fa4668e57af16f1976920a63c99e233a904e73aae3c4f551
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\win32\\svchost.exe" df19cccb4855faee7eb6a933b487cdf4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\win32\\svchost.exe鰀" df19cccb4855faee7eb6a933b487cdf4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\win32\\svchost.exe\uff00" df19cccb4855faee7eb6a933b487cdf4.exe Set value (str) \REGISTRY\USER\S-1-5-21-1985363256-3005190890-1182679451-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Local\\win32\\svchost.exeꔀ" df19cccb4855faee7eb6a933b487cdf4.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe - Suspicious behavior: RenamesItself 29 IoCs
pid Process 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 732 df19cccb4855faee7eb6a933b487cdf4.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 732 df19cccb4855faee7eb6a933b487cdf4.exe 732 df19cccb4855faee7eb6a933b487cdf4.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\df19cccb4855faee7eb6a933b487cdf4.exe"C:\Users\Admin\AppData\Local\Temp\df19cccb4855faee7eb6a933b487cdf4.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:732