Analysis
-
max time kernel
154s -
max time network
154s -
platform
windows10_x64 -
resource
win10-en-20211208 -
submitted
21-12-2021 11:54
Static task
static1
Behavioral task
behavioral1
Sample
313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe
-
Size
67KB
-
MD5
b09d1bafa47c8c3f9a4707b24512e734
-
SHA1
e9abaf7caedeaf5417b8c2d3a88de61f3419a5e1
-
SHA256
313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316
-
SHA512
38119daa05bbe7661520dc913ecb2d890cd817565bd40aa4ab8ccdc48abdd883e6e044f333648cf7caa6e9eb325969888e08a32c60fbf3928a6c40f6c573a512
Score
10/10
Malware Config
Signatures
-
Processes:
313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" 313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" 313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exedescription ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Windows\\wupdsvcs.exe" 313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Users\\Admin\\wupdsvcs.exe" 313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe -
Drops file in Windows directory 2 IoCs
Processes:
313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exedescription ioc Process File created C:\Windows\wupdsvcs.exe 313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe File opened for modification C:\Windows\wupdsvcs.exe 313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe"C:\Users\Admin\AppData\Local\Temp\313c731da99da31454ec6114d5a8ce03dcf9a24caf02270f9292ab7b9278b316.bin.exe"1⤵
- Windows security modification
- Adds Run key to start application
- Drops file in Windows directory
PID:3684