Analysis
-
max time kernel
25s -
max time network
34s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
19-05-2021 10:03
Static task
static1
Behavioral task
behavioral1
Sample
9b5350dd_by_Libranalysis.exe
Resource
win7v20210408
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
9b5350dd_by_Libranalysis.exe
Resource
win10v20210410
windows10_x64
0 signatures
0 seconds
General
-
Target
9b5350dd_by_Libranalysis.exe
-
Size
56KB
-
MD5
9b5350ddf895a5051b90a1cc563753df
-
SHA1
0e45a5f66f5ce300b8c7135450e76afaccc0d332
-
SHA256
2de09a815efcc64810046de69b8e0aa1c9e9beee77b66560a0b15d737485e3c5
-
SHA512
b96a1d383ca4721e3a0481399eb6dee0c1573e1c07140b7ec57c808b89cc6790937e6a7d49c960639a79c5a1bf1595e05834c6ae42c1c6933d2537fb38eaa190
Score
5/10
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
9b5350dd_by_Libranalysis.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat 9b5350dd_by_Libranalysis.exe -
Modifies data under HKEY_USERS 25 IoCs
Processes:
9b5350dd_by_Libranalysis.exedescription ioc process Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionTime = 30f5b176a64cd701 9b5350dd_by_Libranalysis.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecision = "0" 9b5350dd_by_Libranalysis.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadNetworkName = "Network" 9b5350dd_by_Libranalysis.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings 9b5350dd_by_Libranalysis.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 9b5350dd_by_Libranalysis.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" 9b5350dd_by_Libranalysis.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" 9b5350dd_by_Libranalysis.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\WpadDecisionReason = "1" 9b5350dd_by_Libranalysis.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7}\ea-15-24-ab-67-32 9b5350dd_by_Libranalysis.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-24-ab-67-32\WpadDecision = "0" 9b5350dd_by_Libranalysis.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{3A33DB50-CC69-497D-AB93-6EAB524EB9A7} 9b5350dd_by_Libranalysis.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix 9b5350dd_by_Libranalysis.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings 9b5350dd_by_Libranalysis.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad 9b5350dd_by_Libranalysis.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" 9b5350dd_by_Libranalysis.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07000e000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 9b5350dd_by_Libranalysis.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International 9b5350dd_by_Libranalysis.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-24-ab-67-32 9b5350dd_by_Libranalysis.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-24-ab-67-32\WpadDecisionReason = "1" 9b5350dd_by_Libranalysis.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\ea-15-24-ab-67-32\WpadDecisionTime = 30f5b176a64cd701 9b5350dd_by_Libranalysis.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections 9b5350dd_by_Libranalysis.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" 9b5350dd_by_Libranalysis.exe Set value (int) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" 9b5350dd_by_Libranalysis.exe Set value (data) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 9b5350dd_by_Libranalysis.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ 9b5350dd_by_Libranalysis.exe -
Modifies registry class 5 IoCs
Processes:
9b5350dd_by_Libranalysis.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86 9b5350dd_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.53411c86\ = "53411c86" 9b5350dd_by_Libranalysis.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon 9b5350dd_by_Libranalysis.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86 9b5350dd_by_Libranalysis.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\53411c86\DefaultIcon\ = "C:\\ProgramData\\53411c86.ico" 9b5350dd_by_Libranalysis.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
9b5350dd_by_Libranalysis.exepid process 1956 9b5350dd_by_Libranalysis.exe 1956 9b5350dd_by_Libranalysis.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1492 vssvc.exe Token: SeRestorePrivilege 1492 vssvc.exe Token: SeAuditPrivilege 1492 vssvc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
9b5350dd_by_Libranalysis.exe9b5350dd_by_Libranalysis.exedescription pid process target process PID 1188 wrote to memory of 1956 1188 9b5350dd_by_Libranalysis.exe 9b5350dd_by_Libranalysis.exe PID 1188 wrote to memory of 1956 1188 9b5350dd_by_Libranalysis.exe 9b5350dd_by_Libranalysis.exe PID 1188 wrote to memory of 1956 1188 9b5350dd_by_Libranalysis.exe 9b5350dd_by_Libranalysis.exe PID 1188 wrote to memory of 1956 1188 9b5350dd_by_Libranalysis.exe 9b5350dd_by_Libranalysis.exe PID 1188 wrote to memory of 1956 1188 9b5350dd_by_Libranalysis.exe 9b5350dd_by_Libranalysis.exe PID 1956 wrote to memory of 1964 1956 9b5350dd_by_Libranalysis.exe 9b5350dd_by_libranalysis.exe PID 1956 wrote to memory of 1964 1956 9b5350dd_by_Libranalysis.exe 9b5350dd_by_libranalysis.exe PID 1956 wrote to memory of 1964 1956 9b5350dd_by_Libranalysis.exe 9b5350dd_by_libranalysis.exe PID 1956 wrote to memory of 1964 1956 9b5350dd_by_Libranalysis.exe 9b5350dd_by_libranalysis.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_Libranalysis.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exeC:\Users\Admin\AppData\Local\Temp\9b5350dd_by_libranalysis.exe -work worker0 job0-19563⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken