Analysis
-
max time kernel
152s -
max time network
151s -
platform
windows7_x64 -
resource
win7-en-20211208 -
submitted
21-12-2021 11:54
Static task
static1
Behavioral task
behavioral1
Sample
37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exe
Resource
win7-en-20211208
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exe
Resource
win10-en-20211208
0 signatures
0 seconds
General
-
Target
37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exe
-
Size
57KB
-
MD5
339cf597f2c1a184b393fcd2d7396079
-
SHA1
fad28a32fd6d5ec6c63207f25ab4e3396935f525
-
SHA256
37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195
-
SHA512
f5417e1264caf938bfd25137d7e7a530b13033419313c37341223efe950a3aba77459eaa267cc330720154fff76530c860b21ff32ba421dd10e3e789b78397cb
Score
10/10
Malware Config
Signatures
-
Processes:
37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exedescription ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusOverride = "1" 37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesOverride = "1" 37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallOverride = "1" 37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" 37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiSpywareOverride = "1" 37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exe -
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3846991908-3261386348-1409841751-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Update Service = "C:\\Users\\Admin\\winupsrvcs.exe" 37c35d63111e22bb37ed6b22e5886b5178e3bdac3b50977a5aa029accfa5b195.bin.exe