Analysis
-
max time kernel
145s -
max time network
150s -
platform
windows10_x64 -
resource
win10v20210410 -
submitted
20-06-2021 21:45
Static task
static1
Behavioral task
behavioral1
Sample
?????????????????????wsoihsd.com.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
?????????????????????wsoihsd.com.exe
Resource
win10v20210410
General
-
Target
?????????????????????wsoihsd.com.exe
-
Size
1.3MB
-
MD5
b96da8840dfc5642c077fa473bc6611f
-
SHA1
850f1c0cc772eb2d35c97eb3dd6e66b1ff1750bd
-
SHA256
d5aa8ca98c65f958cea8f4a831a15ca2af8c375277a06584ba0d786e919db43c
-
SHA512
942e10b931027ca42fce30d27dc6f02df65e2a1840b6bc0254c84629de2b3b7180a19411cef60c195431efa53f81ec594689e801fedb954a90f86b42d1eec68f
Malware Config
Signatures
-
Executes dropped EXE 2 IoCs
Processes:
Jklmno.exeJklmno.exepid process 1300 Jklmno.exe 1808 Jklmno.exe -
Drops file in Windows directory 4 IoCs
Processes:
_____________________wsoihsd.com.exeJklmno.exedescription ioc process File created C:\Windows\Jklmno.exe _____________________wsoihsd.com.exe File opened for modification C:\Windows\Jklmno.exe _____________________wsoihsd.com.exe File opened for modification C:\Windows\Jklmno.exe Jklmno.exe File created C:\Windows\Jklmno.exe Jklmno.exe -
Modifies data under HKEY_USERS 16 IoCs
Processes:
Jklmno.exeJklmno.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet Jklmno.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Jklmno Qrstuvwx\Group = "Fatal" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software Jklmno.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM\CurrentControlSet\Services\Jklmno Qrstuvwx Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Jklmno Qrstuvwx Jklmno.exe Set value (str) \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services\Jklmno Qrstuvwx\InstallTime = "2021-06-20 21:41" Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\SYSTEM Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\System\CurrentControlSet\Services Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System Jklmno.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows Jklmno.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Policies\System\DisableLockWorkstation = "1" Jklmno.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
_____________________wsoihsd.com.exeJklmno.exeJklmno.exedescription pid process Token: SeDebugPrivilege 3984 _____________________wsoihsd.com.exe Token: SeDebugPrivilege 1300 Jklmno.exe Token: SeDebugPrivilege 1808 Jklmno.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
Jklmno.exedescription pid process target process PID 1300 wrote to memory of 1808 1300 Jklmno.exe Jklmno.exe PID 1300 wrote to memory of 1808 1300 Jklmno.exe Jklmno.exe PID 1300 wrote to memory of 1808 1300 Jklmno.exe Jklmno.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\_____________________wsoihsd.com.exe"C:\Users\Admin\AppData\Local\Temp\_____________________wsoihsd.com.exe"1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\Jklmno.exeC:\Windows\Jklmno.exe1⤵
- Executes dropped EXE
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Jklmno.exeC:\Windows\Jklmno.exe Win72⤵
- Executes dropped EXE
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Public\Documents\SVP7.PNGMD5
b02e46db6e44bab74dccf4cfd14a1076
SHA1295a06cc304356f7f9671c03fc858dc071e1f391
SHA25624448f93ddeadd0d1c71f273e6a080f0f6200cc0c753f88efb06fced3c816ebf
SHA512a53948cdef001502e0dc17c0ecf5331dfcff78c54b41d3a4bd11cbe73afe61a55339689d5192fcad7e7f2a805a7b8ada4fadd3b6e637738c589d5c91603e77b4
-
C:\Windows\Jklmno.exeMD5
b96da8840dfc5642c077fa473bc6611f
SHA1850f1c0cc772eb2d35c97eb3dd6e66b1ff1750bd
SHA256d5aa8ca98c65f958cea8f4a831a15ca2af8c375277a06584ba0d786e919db43c
SHA512942e10b931027ca42fce30d27dc6f02df65e2a1840b6bc0254c84629de2b3b7180a19411cef60c195431efa53f81ec594689e801fedb954a90f86b42d1eec68f
-
C:\Windows\Jklmno.exeMD5
b96da8840dfc5642c077fa473bc6611f
SHA1850f1c0cc772eb2d35c97eb3dd6e66b1ff1750bd
SHA256d5aa8ca98c65f958cea8f4a831a15ca2af8c375277a06584ba0d786e919db43c
SHA512942e10b931027ca42fce30d27dc6f02df65e2a1840b6bc0254c84629de2b3b7180a19411cef60c195431efa53f81ec594689e801fedb954a90f86b42d1eec68f
-
C:\Windows\Jklmno.exeMD5
b96da8840dfc5642c077fa473bc6611f
SHA1850f1c0cc772eb2d35c97eb3dd6e66b1ff1750bd
SHA256d5aa8ca98c65f958cea8f4a831a15ca2af8c375277a06584ba0d786e919db43c
SHA512942e10b931027ca42fce30d27dc6f02df65e2a1840b6bc0254c84629de2b3b7180a19411cef60c195431efa53f81ec594689e801fedb954a90f86b42d1eec68f
-
memory/1300-119-0x0000000010000000-0x000000001002A000-memory.dmpFilesize
168KB
-
memory/1808-121-0x0000000000000000-mapping.dmp
-
memory/3984-114-0x0000000010000000-0x000000001002A000-memory.dmpFilesize
168KB