Analysis
-
max time kernel
8s -
max time network
6s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
27-01-2021 22:14
Static task
static1
Behavioral task
behavioral1
Sample
thanos-cleaned.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
thanos-cleaned.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
Errors
Reason
Machine shutdown
General
-
Target
thanos-cleaned.exe
-
Size
92KB
-
MD5
fe7dcc0f74e152a78963d560b2e3d148
-
SHA1
f9cf1dd1a7e8b2dffc9e0195685cef5a625832ea
-
SHA256
6a5090762c6058bc223e37e89f53832faad80995e3c5ed7e59ed9f5a5e604e47
-
SHA512
a1d2de8abf7e56a2c29bfa38d0ae23584db2174ec8b14c6da3220e1c52ad52861714f8c363be843d16cdf13a22e0b74c16a1cb684ba102f132b09133338a169a
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit = "C:\\Users\\Admin\\AppData\\Local\\Temp\\thanos-cleaned.exe,C:\\Windows\\system32\\userinit.exe" reg.exe -
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
pid Process 1944 bcdedit.exe -
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows Defender\Features thanos-cleaned.exe -
Modifies registry key 1 TTPs 1 IoCs
pid Process 2032 reg.exe -
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 449 IoCs
pid Process 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe 1852 thanos-cleaned.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
description pid Process Token: SeDebugPrivilege 1852 thanos-cleaned.exe Token: SeShutdownPrivilege 528 shutdown.exe Token: SeRemoteShutdownPrivilege 528 shutdown.exe -
Suspicious use of WriteProcessMemory 21 IoCs
description pid Process procid_target PID 1852 wrote to memory of 2032 1852 thanos-cleaned.exe 26 PID 1852 wrote to memory of 2032 1852 thanos-cleaned.exe 26 PID 1852 wrote to memory of 2032 1852 thanos-cleaned.exe 26 PID 1852 wrote to memory of 1944 1852 thanos-cleaned.exe 27 PID 1852 wrote to memory of 1944 1852 thanos-cleaned.exe 27 PID 1852 wrote to memory of 1944 1852 thanos-cleaned.exe 27 PID 1852 wrote to memory of 1988 1852 thanos-cleaned.exe 29 PID 1852 wrote to memory of 1988 1852 thanos-cleaned.exe 29 PID 1852 wrote to memory of 1988 1852 thanos-cleaned.exe 29 PID 1852 wrote to memory of 268 1852 thanos-cleaned.exe 32 PID 1852 wrote to memory of 268 1852 thanos-cleaned.exe 32 PID 1852 wrote to memory of 268 1852 thanos-cleaned.exe 32 PID 1852 wrote to memory of 528 1852 thanos-cleaned.exe 33 PID 1852 wrote to memory of 528 1852 thanos-cleaned.exe 33 PID 1852 wrote to memory of 528 1852 thanos-cleaned.exe 33 PID 1852 wrote to memory of 1872 1852 thanos-cleaned.exe 37 PID 1852 wrote to memory of 1872 1852 thanos-cleaned.exe 37 PID 1852 wrote to memory of 1872 1852 thanos-cleaned.exe 37 PID 268 wrote to memory of 1776 268 net.exe 38 PID 268 wrote to memory of 1776 268 net.exe 38 PID 268 wrote to memory of 1776 268 net.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\thanos-cleaned.exe"C:\Users\Admin\AppData\Local\Temp\thanos-cleaned.exe"1⤵
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1852 -
C:\Windows\system32\reg.exe"reg.exe" delete HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend /f2⤵
- Modifies registry key
PID:2032
-
-
C:\Windows\system32\bcdedit.exe"bcdedit.exe" /set {default} safeboot network2⤵
- Modifies boot configuration data using bcdedit
PID:1944
-
-
C:\Windows\system32\reg.exe"reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\thanos-cleaned.exe","C:\Windows\system32\userinit.exe" /f2⤵
- Modifies WinLogon for persistence
PID:1988
-
-
C:\Windows\system32\net.exe"net.exe" user Admin ""2⤵
- Suspicious use of WriteProcessMemory
PID:268 -
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin ""3⤵PID:1776
-
-
-
C:\Windows\system32\shutdown.exe"shutdown.exe" /r /t 02⤵
- Suspicious use of AdjustPrivilegeToken
PID:528
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵PID:1872
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:792
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵PID:1584