Analysis
-
max time kernel
159s -
max time network
168s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-12-2021 11:54
Static task
static1
Behavioral task
behavioral1
Sample
cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe
-
Size
67KB
-
MD5
b8773ca78a7a972aac9237895022b78e
-
SHA1
3a0d2a91d279c37836cf265174330b53b329ab3c
-
SHA256
cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254
-
SHA512
564843dcccdd99358c964448fcf6bbb23abe438d09a7fccfc5d8ed21b3a02d0856a5858da2f73d8ddcba7accbbdc3097423add0d5d0be282042b6689c34b4a06
Score
10/10
Malware Config
Signatures
-
Processes:
cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Windows\\winudsvcs.exe" cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Users\\Admin\\winudsvcs.exe" cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe -
Drops file in Windows directory 2 IoCs
Processes:
cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exedescription ioc Process File created C:\Windows\winudsvcs.exe cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe File opened for modification C:\Windows\winudsvcs.exe cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe"C:\Users\Admin\AppData\Local\Temp\cf79b1db1c515944e8076170b8d8c2f72747c99e3c686b85422f8d3fd033b254.bin.exe"1⤵
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
PID:3048