Analysis
-
max time kernel
155s -
max time network
168s -
platform
windows10_x64 -
resource
win10-en-20210920 -
submitted
17-10-2021 07:11
Behavioral task
behavioral1
Sample
3fc37dc097e9af0bde7a150d600b9162.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
3fc37dc097e9af0bde7a150d600b9162.exe
Resource
win10-en-20210920
windows10_x64
0 signatures
0 seconds
General
-
Target
3fc37dc097e9af0bde7a150d600b9162.exe
-
Size
93KB
-
MD5
3fc37dc097e9af0bde7a150d600b9162
-
SHA1
651f143d624f21827550ba8da11813ce74450429
-
SHA256
3765c62b096e83b14eebdf89ec78683e373be4fb4c63de1e599981979f79168f
-
SHA512
e825dad16affbd61c18a69b0f35f224ff42510b088b783d39d96e6471b3be2feec1290f45da3b0bab9943e0be5c84a4ff83233316d9196e1bf79579d0f5f0fc4
Score
8/10
Malware Config
Signatures
-
Disables Task Manager via registry modification
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 4 IoCs
Processes:
3fc37dc097e9af0bde7a150d600b9162.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe 3fc37dc097e9af0bde7a150d600b9162.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe 3fc37dc097e9af0bde7a150d600b9162.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c32002b041e622ed9509aeeaf370e5bWindows Update.exe 3fc37dc097e9af0bde7a150d600b9162.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6c32002b041e622ed9509aeeaf370e5bWindows Update.exe 3fc37dc097e9af0bde7a150d600b9162.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
3fc37dc097e9af0bde7a150d600b9162.exepid process 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe 2352 3fc37dc097e9af0bde7a150d600b9162.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
3fc37dc097e9af0bde7a150d600b9162.exepid process 2352 3fc37dc097e9af0bde7a150d600b9162.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
3fc37dc097e9af0bde7a150d600b9162.exedescription pid process Token: SeDebugPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: 33 2352 3fc37dc097e9af0bde7a150d600b9162.exe Token: SeIncBasePriorityPrivilege 2352 3fc37dc097e9af0bde7a150d600b9162.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
3fc37dc097e9af0bde7a150d600b9162.exedescription pid process target process PID 2352 wrote to memory of 504 2352 3fc37dc097e9af0bde7a150d600b9162.exe netsh.exe PID 2352 wrote to memory of 504 2352 3fc37dc097e9af0bde7a150d600b9162.exe netsh.exe PID 2352 wrote to memory of 504 2352 3fc37dc097e9af0bde7a150d600b9162.exe netsh.exe PID 2352 wrote to memory of 3888 2352 3fc37dc097e9af0bde7a150d600b9162.exe netsh.exe PID 2352 wrote to memory of 3888 2352 3fc37dc097e9af0bde7a150d600b9162.exe netsh.exe PID 2352 wrote to memory of 3888 2352 3fc37dc097e9af0bde7a150d600b9162.exe netsh.exe PID 2352 wrote to memory of 2052 2352 3fc37dc097e9af0bde7a150d600b9162.exe netsh.exe PID 2352 wrote to memory of 2052 2352 3fc37dc097e9af0bde7a150d600b9162.exe netsh.exe PID 2352 wrote to memory of 2052 2352 3fc37dc097e9af0bde7a150d600b9162.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\3fc37dc097e9af0bde7a150d600b9162.exe"C:\Users\Admin\AppData\Local\Temp\3fc37dc097e9af0bde7a150d600b9162.exe"1⤵
- Drops startup file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3fc37dc097e9af0bde7a150d600b9162.exe" "3fc37dc097e9af0bde7a150d600b9162.exe" ENABLE2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\3fc37dc097e9af0bde7a150d600b9162.exe"2⤵
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\3fc37dc097e9af0bde7a150d600b9162.exe" "3fc37dc097e9af0bde7a150d600b9162.exe" ENABLE2⤵