Analysis
-
max time kernel
13s -
max time network
8s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
28-05-2021 09:57
General
-
Target
5026eddb6f757aba5701d674a948372f2436756ee6a72c95228801a782f649cd.bin.sample.exe
-
Size
175KB
-
MD5
da09586ba925a20faa4a2879697c9238
-
SHA1
ab6ca1d039ac2d54a811486d731ebf94ad61bf47
-
SHA256
5026eddb6f757aba5701d674a948372f2436756ee6a72c95228801a782f649cd
-
SHA512
80f8b6a17fe17192244a223c8b6618b70a19e8bd0cb5179b1b058c455e36c32f53c2e7402e25144e3bbb800c56ef0ad2ac6a363c4d1615ff1ea84a0c1ab371e1
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 21 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\5026eddb6f757aba5701d674a948372f2436756ee6a72c95228801a782f649cd.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\5026eddb6f757aba5701d674a948372f2436756ee6a72c95228801a782f649cd.bin.sample.exe"1⤵
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg.exe" delete HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend /f2⤵
- Modifies registry key
-
-
C:\Windows\system32\bcdedit.exe"bcdedit.exe" /set {default} safeboot network2⤵
- Modifies boot configuration data using bcdedit
-
-
C:\Windows\system32\reg.exe"reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\5026eddb6f757aba5701d674a948372f2436756ee6a72c95228801a782f649cd.bin.sample.exe","C:\Windows\system32\userinit.exe" /f2⤵
- Modifies WinLogon for persistence
-
-
C:\Windows\system32\net.exe"net.exe" user Admin ""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin ""3⤵
-
-
-
C:\Windows\system32\shutdown.exe"shutdown.exe" /r /t 02⤵
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
-
Filesize
4KB
-
Filesize
8KB
-
-
Filesize
8KB
-
Filesize
4KB
-
-
-
-
-