Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
19-04-2021 05:51
Static task
static1
Behavioral task
behavioral1
Sample
b2ebdf85608402d4210c9ecbab49002f.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
b2ebdf85608402d4210c9ecbab49002f.exe
Resource
win10v20210408
windows10_x64
0 signatures
0 seconds
General
-
Target
b2ebdf85608402d4210c9ecbab49002f.exe
-
Size
37KB
-
MD5
b2ebdf85608402d4210c9ecbab49002f
-
SHA1
8672edb24a4a7c0e82a2566b720f4ee347ddf476
-
SHA256
ee56f404e806f2c7c4a261236ae00dcd73461e84748f3d6d229a15ca555d4583
-
SHA512
0e86a80059ac9dc69b456bf4574f50cc73a45a3c54bf268453b38a0be0c224beed785250a32fb3d92bca1e6763750ac77eba9a139f09f7c206368358a3814496
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
b2ebdf85608402d4210c9ecbab49002f.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3d491618682ffcbb92697703a5e3c994.exe b2ebdf85608402d4210c9ecbab49002f.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\3d491618682ffcbb92697703a5e3c994.exe b2ebdf85608402d4210c9ecbab49002f.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
b2ebdf85608402d4210c9ecbab49002f.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\3d491618682ffcbb92697703a5e3c994 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b2ebdf85608402d4210c9ecbab49002f.exe\" .." b2ebdf85608402d4210c9ecbab49002f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\3d491618682ffcbb92697703a5e3c994 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\b2ebdf85608402d4210c9ecbab49002f.exe\" .." b2ebdf85608402d4210c9ecbab49002f.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
b2ebdf85608402d4210c9ecbab49002f.exepid process 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe 4000 b2ebdf85608402d4210c9ecbab49002f.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
b2ebdf85608402d4210c9ecbab49002f.exepid process 4000 b2ebdf85608402d4210c9ecbab49002f.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
b2ebdf85608402d4210c9ecbab49002f.exedescription pid process Token: SeDebugPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: 33 4000 b2ebdf85608402d4210c9ecbab49002f.exe Token: SeIncBasePriorityPrivilege 4000 b2ebdf85608402d4210c9ecbab49002f.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
b2ebdf85608402d4210c9ecbab49002f.exedescription pid process target process PID 4000 wrote to memory of 2624 4000 b2ebdf85608402d4210c9ecbab49002f.exe netsh.exe PID 4000 wrote to memory of 2624 4000 b2ebdf85608402d4210c9ecbab49002f.exe netsh.exe PID 4000 wrote to memory of 2624 4000 b2ebdf85608402d4210c9ecbab49002f.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\b2ebdf85608402d4210c9ecbab49002f.exe"C:\Users\Admin\AppData\Local\Temp\b2ebdf85608402d4210c9ecbab49002f.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4000 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\b2ebdf85608402d4210c9ecbab49002f.exe" "b2ebdf85608402d4210c9ecbab49002f.exe" ENABLE2⤵PID:2624