Analysis
-
max time kernel
9s -
max time network
15s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
01-09-2021 03:28
Static task
static1
Behavioral task
behavioral1
Sample
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
Resource
win10v20210408
General
-
Target
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
-
Size
56KB
-
MD5
3f2cb535fc5bc296aa5b0d2897c265d0
-
SHA1
c30358563fa940eb5cd6064d4d16defee43b0310
-
SHA256
f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4
-
SHA512
6fc3a98f16f4fbd2e6bd4211c35b403ed565d6b30f803e6da04e14efe018aca09719256f1e8a2c8a5763a7bac08de3be964eb6251d858df0f6261f82b3f2f7a2
Malware Config
Signatures
-
Drops file in System32 directory 1 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exedescription ioc process File opened for modification C:\Windows\SysWOW64\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe -
Modifies data under HKEY_USERS 25 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exedescription ioc process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\AutoDetect = "1" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionReason = "1" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadNetworkName = "Network" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32} mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecision = "0" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\02-cd-be-3d-b4-ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Key created \REGISTRY\USER\.DEFAULT\Control Panel\International mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Cookies\CachePrefix = "Cookie:" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ProxyEnable = "0" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\UNCAsIntranet = "0" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\ZoneMap\ mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\{2A905F01-0A57-4E51-8685-54144DDC3A32}\WpadDecisionTime = d0cf38e8e19ed701 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-cd-be-3d-b4-ab\WpadDecisionReason = "1" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-cd-be-3d-b4-ab\WpadDecision = "0" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\Content\CachePrefix mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (str) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\5.0\Cache\History\CachePrefix = "Visited:" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\DefaultConnectionSettings = 4600000003000000090000000000000000000000000000000400000000000000000000000000000000000000000000000000000001000000020000000a07001f000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-cd-be-3d-b4-ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Wpad\02-cd-be-3d-b4-ab\WpadDecisionTime = d0cf38e8e19ed701 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Key created \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\Internet Settings mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\Connections\SavedLegacySettings = 4600000002000000090000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000000 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe -
Modifies registry class 5 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exedescription ioc process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon\ = "C:\\ProgramData\\949640ab.ico" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.949640ab\ = "949640ab" mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\949640ab\DefaultIcon mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exepid process 1932 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe 1932 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe -
Suspicious use of AdjustPrivilegeToken 3 IoCs
Processes:
vssvc.exedescription pid process Token: SeBackupPrivilege 1720 vssvc.exe Token: SeRestorePrivilege 1720 vssvc.exe Token: SeAuditPrivilege 1720 vssvc.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exemhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exedescription pid process target process PID 1228 wrote to memory of 1932 1228 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe PID 1228 wrote to memory of 1932 1228 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe PID 1228 wrote to memory of 1932 1228 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe PID 1228 wrote to memory of 1932 1228 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe PID 1228 wrote to memory of 1932 1228 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe PID 1932 wrote to memory of 632 1932 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe PID 1932 wrote to memory of 632 1932 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe PID 1932 wrote to memory of 632 1932 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe PID 1932 wrote to memory of 632 1932 mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"1⤵
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"1⤵
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe"2⤵
- Drops file in System32 directory
- Modifies data under HKEY_USERS
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exeC:\Users\Admin\AppData\Local\Temp\mhcomputing.net_f3f25af554bedfa4ee2824bb858280282bd87828d446048619dc49fe061741b4_jk5rpxi6.exe -work worker0 job0-19323⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken