Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-12-2021 11:54
Static task
static1
Behavioral task
behavioral1
Sample
1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe
-
Size
67KB
-
MD5
a2f1c7def6b73a5bbbdfea5c01482d87
-
SHA1
68dda756a9b36df90c81329fb83fab2abac0656f
-
SHA256
1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010
-
SHA512
28bd3b3e5587215bf4b48df1ad5885e76c4bd128d6ea8f30f22008120384c1d2aaf2b73298842443469f5c6d9ebe5be32e2d648ade69876333b66e64309d13fb
Score
10/10
Malware Config
Signatures
-
Processes:
1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Windows\\wpdsvcs.exe" 1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Users\\Admin\\wpdsvcs.exe" 1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe -
Drops file in Windows directory 2 IoCs
Processes:
1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exedescription ioc Process File created C:\Windows\wpdsvcs.exe 1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe File opened for modification C:\Windows\wpdsvcs.exe 1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe"C:\Users\Admin\AppData\Local\Temp\1d69a55baba58f62b1448b92859a39272ba42d171f390749ca8ba9c27e74b010.bin.exe"1⤵
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
PID:3800