Analysis
- max time kernel
150s - max time network
142s - platform
windows10_x64 - resource
win10v20210410 - submitted
04/05/2021, 06:21
Static task
static1
Behavioral task
behavioral1
Sample
BB7831B05E13694DC04F60AF29A8DA21.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
BB7831B05E13694DC04F60AF29A8DA21.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
- Target BB7831B05E13694DC04F60AF29A8DA21.exe
- Size 1.4MB
- Sample210504-9719jqqdp2
- SHA256 e655b06ea5b0dad25ad463a66bff53789b15763a87ddd17336aab9ebd5b2eb87
- MD5 bb7831b05e13694dc04f60af29a8da21
- SHA1 8c9a80c2003075b731139d18a18bf308a62e0210
- SHA512 09abda475576950b66d9c40398271f3685451a5f416ec399b0aa86331316940dfe420320f0fcd90584a3d4cd6b67a931a8730098da5290451b7f7a9460ca685c
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHostExecutable = "C:\\Users\\Admin\\AppData\\Local\\WindowsHost\\WindowsHostExecutable.exe" BB7831B05E13694DC04F60AF29A8DA21.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHostExecutable = "C:\\Users\\Admin\\AppData\\Local\\WindowsHost\\WindowsHostExecutable.exe\uf800" BB7831B05E13694DC04F60AF29A8DA21.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHostExecutable = "C:\\Users\\Admin\\AppData\\Local\\WindowsHost\\WindowsHostExecutable.exe儀" BB7831B05E13694DC04F60AF29A8DA21.exe Set value (str) \REGISTRY\USER\S-1-5-21-3686645723-710336880-414668232-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsHostExecutable = "C:\\Users\\Admin\\AppData\\Local\\WindowsHost\\WindowsHostExecutable.exe眀" BB7831B05E13694DC04F60AF29A8DA21.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs
pid Process 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe - Suspicious behavior: RenamesItself 30 IoCs
pid Process 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeShutdownPrivilege 3400 BB7831B05E13694DC04F60AF29A8DA21.exe - Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 3400 BB7831B05E13694DC04F60AF29A8DA21.exe 3400 BB7831B05E13694DC04F60AF29A8DA21.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\BB7831B05E13694DC04F60AF29A8DA21.exe"C:\Users\Admin\AppData\Local\Temp\BB7831B05E13694DC04F60AF29A8DA21.exe"1⤵
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3400