Analysis
-
max time kernel
150s -
max time network
150s -
platform
windows7_x64 -
resource
win7-en-20211014 -
submitted
11-11-2021 01:21
Behavioral task
behavioral1
Sample
a8535d5778f0d6177d4a0f6623ae7ad5.exe
Resource
win7-en-20211014
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a8535d5778f0d6177d4a0f6623ae7ad5.exe
Resource
win10-en-20211104
windows10_x64
0 signatures
0 seconds
General
-
Target
a8535d5778f0d6177d4a0f6623ae7ad5.exe
-
Size
37KB
-
MD5
a8535d5778f0d6177d4a0f6623ae7ad5
-
SHA1
a45fdd4f8b93faf01e70a3635d3ea0dd8ffd9d52
-
SHA256
0f9a62ff1c6cd64e3f114e61890c62c3e7ac67f1b96010e0d5017386aae9d845
-
SHA512
c5d3d52329f6147c4688970efdeb3a2ef7f491c4ebd9f78598557f08aa039a6fadd194e6a76edd9d931d493c3fb6f65c787002f08f8c57db52c67de0f766f0b5
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
a8535d5778f0d6177d4a0f6623ae7ad5.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6522a3fb379b191d0e0a5738f031acf1.exe a8535d5778f0d6177d4a0f6623ae7ad5.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\6522a3fb379b191d0e0a5738f031acf1.exe a8535d5778f0d6177d4a0f6623ae7ad5.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
a8535d5778f0d6177d4a0f6623ae7ad5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\6522a3fb379b191d0e0a5738f031acf1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a8535d5778f0d6177d4a0f6623ae7ad5.exe\" .." a8535d5778f0d6177d4a0f6623ae7ad5.exe Set value (str) \REGISTRY\USER\S-1-5-21-2955169046-2371869340-1800780948-1000\Software\Microsoft\Windows\CurrentVersion\Run\6522a3fb379b191d0e0a5738f031acf1 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\a8535d5778f0d6177d4a0f6623ae7ad5.exe\" .." a8535d5778f0d6177d4a0f6623ae7ad5.exe -
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 992 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
a8535d5778f0d6177d4a0f6623ae7ad5.exepid process 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
a8535d5778f0d6177d4a0f6623ae7ad5.exepid process 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe -
Suspicious use of AdjustPrivilegeToken 34 IoCs
Processes:
a8535d5778f0d6177d4a0f6623ae7ad5.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeDebugPrivilege 992 taskkill.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: 33 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe Token: SeIncBasePriorityPrivilege 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
a8535d5778f0d6177d4a0f6623ae7ad5.exedescription pid process target process PID 1916 wrote to memory of 1792 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe netsh.exe PID 1916 wrote to memory of 1792 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe netsh.exe PID 1916 wrote to memory of 1792 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe netsh.exe PID 1916 wrote to memory of 1792 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe netsh.exe PID 1916 wrote to memory of 992 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe taskkill.exe PID 1916 wrote to memory of 992 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe taskkill.exe PID 1916 wrote to memory of 992 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe taskkill.exe PID 1916 wrote to memory of 992 1916 a8535d5778f0d6177d4a0f6623ae7ad5.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a8535d5778f0d6177d4a0f6623ae7ad5.exe"C:\Users\Admin\AppData\Local\Temp\a8535d5778f0d6177d4a0f6623ae7ad5.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\a8535d5778f0d6177d4a0f6623ae7ad5.exe" "a8535d5778f0d6177d4a0f6623ae7ad5.exe" ENABLE2⤵
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken