Analysis
-
max time kernel
154s -
max time network
155s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-12-2021 11:54
Static task
static1
Behavioral task
behavioral1
Sample
197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exe
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exe
-
Size
57KB
-
MD5
8e217c91e2dc1df76026f1177c1c6e4e
-
SHA1
9b4a5ecd56daafdd0d1d7fed2254cc9c214a11bc
-
SHA256
197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd
-
SHA512
7386acf007ba5e83f05d54b8cce0be808d8429f0ba1656ca1656c9dc933231397704c04f794a96f63df267ab58b1a7d76e3432b3db3d29e0a2c399534c037cad
Score
10/10
Malware Config
Signatures
-
Processes:
197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-369956170-74428499-1628131376-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Users\\Admin\\winupsvcs.exe" 197286269fe0f8ef718beb337945c88e3b88683ff39c05137b71d7cd662c7ddd.bin.exe