Analysis
-
max time kernel
166s -
max time network
168s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-12-2021 11:54
Static task
static1
Behavioral task
behavioral1
Sample
8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exe
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exe
-
Size
57KB
-
MD5
bfbde2f75d5dfcf956309091dc25a2c7
-
SHA1
a0eff047d4468a90ef437e48bbdfc3edf94f79d8
-
SHA256
8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c
-
SHA512
1fe3d09c57b22958aa3669fc2639c9158252d05000ea0733972c83cd8b90365e776a13076890951d2d5d5b30523ba8a0fa6d908dcf435fba77e9c3ed6aa3ee43
Score
10/10
Malware Config
Signatures
-
Processes:
8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Users\\Admin\\winupscvs.exe" 8d413fb17a9fb2722c36b288de4cf2564a25d11bd63673191fc9be22bffc227c.bin.exe