Analysis
- max time kernel
143s - max time network
149s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
07/01/2022, 08:38
Static task
static1
Behavioral task
behavioral1
Sample
1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target 1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe
- Size 1.6MB
- Sample220107-kjrwsscdhj
- SHA256 1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac
- MD5 66ceed25f051d153e9ea06a99707c076
- SHA1 f400d036bea237ac6502a689335bd9930ed233ed
- SHA512 46f24bfad147db445d8cdf07ea6a7c93cca78718dd696959219b7f286fc4a17c22256e3fc048b1cbbd644f71816caa0a5710d910d197531368027e5a7a260140
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 2 IoCs
pid Process 1360 AWrjar.exe 1272 AWrjar.exe - Enumerates connected drives 3 TTPs 23 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\I: AWrjar.exe File opened (read-only) \??\K: AWrjar.exe File opened (read-only) \??\Q: AWrjar.exe File opened (read-only) \??\V: AWrjar.exe File opened (read-only) \??\Z: AWrjar.exe File opened (read-only) \??\B: AWrjar.exe File opened (read-only) \??\H: AWrjar.exe File opened (read-only) \??\L: AWrjar.exe File opened (read-only) \??\S: AWrjar.exe File opened (read-only) \??\W: AWrjar.exe File opened (read-only) \??\F: AWrjar.exe File opened (read-only) \??\T: AWrjar.exe File opened (read-only) \??\X: AWrjar.exe File opened (read-only) \??\G: AWrjar.exe File opened (read-only) \??\J: AWrjar.exe File opened (read-only) \??\M: AWrjar.exe File opened (read-only) \??\N: AWrjar.exe File opened (read-only) \??\O: AWrjar.exe File opened (read-only) \??\P: AWrjar.exe File opened (read-only) \??\R: AWrjar.exe File opened (read-only) \??\U: AWrjar.exe File opened (read-only) \??\E: AWrjar.exe File opened (read-only) \??\Y: AWrjar.exe - Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\AWrjar.exe 1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe File opened for modification C:\Windows\SysWOW64\AWrjar.exe 1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe - Suspicious use of NtSetInformationThreadHideFromDebugger 17 IoCs
pid Process 2652 1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe 1360 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe - Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 AWrjar.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz AWrjar.exe - Modifies data under HKEY_USERS 5 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum AWrjar.exe Key created \REGISTRY\USER\.DEFAULT\Software AWrjar.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft AWrjar.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie AWrjar.exe Set value (int) \REGISTRY\USER\.DEFAULT\Software\Microsoft\ActiveMovie\devenum\Version = "7" AWrjar.exe - Runs ping.exe 1 TTPs 1 IoCs
pid Process 1488 PING.EXE - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe 1272 AWrjar.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeIncBasePriorityPrivilege 2652 1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe - Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2652 1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe 1360 AWrjar.exe 1272 AWrjar.exe - Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 2652 wrote to memory of 1060 2652 1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe 69 PID 2652 wrote to memory of 1060 2652 1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe 69 PID 2652 wrote to memory of 1060 2652 1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe 69 PID 1360 wrote to memory of 1272 1360 AWrjar.exe 70 PID 1360 wrote to memory of 1272 1360 AWrjar.exe 70 PID 1360 wrote to memory of 1272 1360 AWrjar.exe 70 PID 1060 wrote to memory of 1488 1060 cmd.exe 72 PID 1060 wrote to memory of 1488 1060 cmd.exe 72 PID 1060 wrote to memory of 1488 1060 cmd.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe"C:\Users\Admin\AppData\Local\Temp\1bd4eeb7f7ae8a4ca1fb2fcf673cbb810ca123d6672a1d6d10ed317688ffcfac.exe"1⤵
- Drops file in System32 directory
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2652 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ping -n 2 127.0.0.1 > nul && del C:\Users\Admin\AppData\Local\Temp\1BD4EE~1.EXE > nul2⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\PING.EXEping -n 2 127.0.0.13⤵
- Runs ping.exe
PID:1488
-
-
-
C:\Windows\SysWOW64\AWrjar.exeC:\Windows\SysWOW64\AWrjar.exe -auto1⤵
- Executes dropped EXE
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\AWrjar.exeC:\Windows\SysWOW64\AWrjar.exe -acsi2⤵
- Executes dropped EXE
- Enumerates connected drives
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Checks processor information in registry
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
PID:1272
-