Analysis
- max time kernel
13s - max time network
152s - platform
windows10_x64 - resource
win10v20210408 - submitted
28/07/2021, 18:02
Static task
static1
Behavioral task
behavioral1
Sample
e52f3372030bb435777d88a709187eea.exe
Resource
win7v20210410
windows7_x64
0 signatures
0 seconds
General
- Target e52f3372030bb435777d88a709187eea.exe
- Size 4.0MB
- Sample210728-jt33z4rtda
- SHA256 39a77ef363317beea8cad0c8dfe80791ee12647f61396cbfa0128b73113bab8d
- MD5 e52f3372030bb435777d88a709187eea
- SHA1 08d3fde9daa0f0c9d9e924110c9d559486c8b6dc
- SHA512 2c7006c479012d49b479cf49450768ac91d847c82e38d024191f3b652496469ed653d04516a01d11b28d9130ee5fafbac279b2cc87420ac37eb0ae6196991990
- MD5 SHA1 SHA512
Malware Config
Signatures
- Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" e52f3372030bb435777d88a709187eea.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" e52f3372030bb435777d88a709187eea.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "1" e52f3372030bb435777d88a709187eea.exe -
resource yara_rule behavioral2/memory/504-114-0x0000000002220000-0x00000000032AE000-memory.dmp upx -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" e52f3372030bb435777d88a709187eea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UacDisableNotify = "1" e52f3372030bb435777d88a709187eea.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\Svc e52f3372030bb435777d88a709187eea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" e52f3372030bb435777d88a709187eea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" e52f3372030bb435777d88a709187eea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" e52f3372030bb435777d88a709187eea.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" e52f3372030bb435777d88a709187eea.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e52f3372030bb435777d88a709187eea.exe - Drops file in Windows directory 1 IoCs
description ioc Process File opened for modification C:\Windows\SYSTEM.INI e52f3372030bb435777d88a709187eea.exe - Program crash 1 IoCs
pid pid_target Process procid_target 204 504 WerFault.exe 67 - Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 504 e52f3372030bb435777d88a709187eea.exe 504 e52f3372030bb435777d88a709187eea.exe - Suspicious use of AdjustPrivilegeToken 60 IoCs
description pid Process Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe Token: SeDebugPrivilege 504 e52f3372030bb435777d88a709187eea.exe - Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 504 wrote to memory of 716 504 e52f3372030bb435777d88a709187eea.exe 66 PID 504 wrote to memory of 720 504 e52f3372030bb435777d88a709187eea.exe 9 PID 504 wrote to memory of 980 504 e52f3372030bb435777d88a709187eea.exe 63 PID 504 wrote to memory of 2452 504 e52f3372030bb435777d88a709187eea.exe 42 PID 504 wrote to memory of 2640 504 e52f3372030bb435777d88a709187eea.exe 36 PID 504 wrote to memory of 2860 504 e52f3372030bb435777d88a709187eea.exe 34 PID 504 wrote to memory of 2224 504 e52f3372030bb435777d88a709187eea.exe 33 PID 504 wrote to memory of 3252 504 e52f3372030bb435777d88a709187eea.exe 32 PID 504 wrote to memory of 3260 504 e52f3372030bb435777d88a709187eea.exe 31 PID 504 wrote to memory of 3484 504 e52f3372030bb435777d88a709187eea.exe 30 PID 504 wrote to memory of 3724 504 e52f3372030bb435777d88a709187eea.exe 29 PID 504 wrote to memory of 1572 504 e52f3372030bb435777d88a709187eea.exe 74 - System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" e52f3372030bb435777d88a709187eea.exe
Processes
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:720
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{3EB3C877-1F16-487C-9050-104DBCD66683}1⤵PID:3724
-
C:\Windows\System32\RuntimeBroker.exeC:\Windows\System32\RuntimeBroker.exe -Embedding1⤵PID:3484
-
C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe"C:\Windows\SystemApps\Microsoft.Windows.Cortana_cw5n1h2txyewy\SearchUI.exe" -ServerName:CortanaUI.AppXa50dqqa5gqv4a428c9y1jjw7m3btvepj.mca1⤵PID:3260
-
C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe"C:\Windows\SystemApps\ShellExperienceHost_cw5n1h2txyewy\ShellExperienceHost.exe" -ServerName:App.AppXtk181tbxbce2qsex02s8tw7hfxa9xb3t.mca1⤵PID:3252
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵PID:2224
-
C:\Users\Admin\AppData\Local\Temp\e52f3372030bb435777d88a709187eea.exe"C:\Users\Admin\AppData\Local\Temp\e52f3372030bb435777d88a709187eea.exe"2⤵
- Modifies firewall policy service
- Windows security modification
- Checks whether UAC is enabled
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:504 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 504 -s 10803⤵
- Program crash
PID:204
-
-
-
c:\windows\system32\taskhostw.exetaskhostw.exe {222A245B-E637-4AE9-A93F-A59CA119A75E}1⤵PID:2860
-
c:\windows\system32\svchost.exec:\windows\system32\svchost.exe -k unistacksvcgroup -s CDPUserSvc1⤵PID:2640
-
c:\windows\system32\sihost.exesihost.exe1⤵PID:2452
-
C:\Windows\system32\dwm.exe"dwm.exe"1⤵PID:980
-
C:\Windows\system32\fontdrvhost.exe"fontdrvhost.exe"1⤵PID:716
-
C:\Windows\system32\DllHost.exeC:\Windows\system32\DllHost.exe /Processid:{AB8902B4-09CA-4BB6-B78D-A8F59079A8D5}1⤵PID:1572