Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
30/09/2021, 22:03
Behavioral task
behavioral1
Sample
C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe
Resource
win7-en-20210920
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe
-
Size
31KB
-
MD5
4adad151f3c235616ce57238c32b4b34
-
SHA1
9d05a045e0ce402ff257d799921a9557a2569535
-
SHA256
c50488a31b6ce8d0ddd65b57bd27cf8c1bc86ad0382476f813c33083c5575d6f
-
SHA512
34b9607899e79f6e381c648f6afde801aed03e4041c9affc13d4855032d139f5164b7f2c4adfea56366d3365dd758fe9c86110b2148cc0c744f04945fc79a366
Score
10/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\33aef9319e7f69a68e51dc4a67780130.exe C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\33aef9319e7f69a68e51dc4a67780130.exe C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2481030822-2828258191-1606198294-1000\Software\Microsoft\Windows\CurrentVersion\Run\33aef9319e7f69a68e51dc4a67780130 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe\" .." C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\33aef9319e7f69a68e51dc4a67780130 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe\" .." C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: 33 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe Token: SeIncBasePriorityPrivilege 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2144 wrote to memory of 2424 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 70 PID 2144 wrote to memory of 2424 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 70 PID 2144 wrote to memory of 2424 2144 C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe 70
Processes
-
C:\Users\Admin\AppData\Local\Temp\C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe"C:\Users\Admin\AppData\Local\Temp\C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2144 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe" "C50488A31B6CE8D0DDD65B57BD27CF8C1BC86AD038247.exe" ENABLE2⤵PID:2424
-