Analysis
- max time kernel
119s - max time network
151s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
24/01/2022, 01:08
Static task
static1
Behavioral task
behavioral1
Sample
c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe
- Size 164KB
- Sample220124-bha28ahcd9
- SHA256 c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390
- MD5 05bdfc5aae2670314d0b248427a56b36
- SHA1 33e1b6b524cbba471ec8638d1cc79e95c2bc415f
- SHA512 b2d7bb4ee01dc06e90096ecd558f83a32644b296521082214c485e952b9d36be8419499802d15937c8d51aa47589d99f9025ba139bc4289fc419a5548cd8f333
- MD5 SHA1 SHA512
Score
6/10
Malware Config
Signatures
- Enumerates connected drives 3 TTPs 24 IoCs
Attempts to read the root path of hard drives other than the default C: drive.
description ioc Process File opened (read-only) \??\E: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\L: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\T: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\X: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\Y: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\S: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\U: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\V: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\Z: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\R: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\G: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\I: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\J: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\K: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\P: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\N: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\O: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\Q: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\A: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\B: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\F: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\H: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\M: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe File opened (read-only) \??\W: c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe - Modifies data under HKEY_USERS 42 IoCs
description ioc Process Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\WinTrust\Trust Providers\Software Publishing powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\Root\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\trust\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\trust\CRLs powershell.exe Set value (data) \REGISTRY\USER\.DEFAULT\Software\Classes\Local Settings\MuiCache\16\52C64B7E\LanguageList = 65006e002d0055005300000065006e0000000000 powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\SmartCardRoot\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\TrustedPeople\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\TrustedPeople\Certificates powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CRLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\CA\CTLs powershell.exe Key created \REGISTRY\USER\.DEFAULT\Software\Policies\Microsoft\SystemCertificates\Disallowed\CRLs powershell.exe - Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 2608 c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe 2608 c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe 2608 c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe 2608 c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe 1328 powershell.exe 1328 powershell.exe 1328 powershell.exe - Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: SeDebugPrivilege 1328 powershell.exe Token: SeBackupPrivilege 1088 vssvc.exe Token: SeRestorePrivilege 1088 vssvc.exe Token: SeAuditPrivilege 1088 vssvc.exe - Suspicious use of WriteProcessMemory 2 IoCs
description pid Process procid_target PID 2608 wrote to memory of 1328 2608 c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe 72 PID 2608 wrote to memory of 1328 2608 c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe 72
Processes
-
C:\Users\Admin\AppData\Local\Temp\c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe"C:\Users\Admin\AppData\Local\Temp\c3669070ec6f303b54314f9301e1294f86afbe22e379773397100d85fc9a4390.exe"1⤵
- Enumerates connected drives
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:2608 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell.exe -e RwBlAHQALQBXAG0AaQBPAGIAagBlAGMAdAAgAFcAaQBuADMAMgBfAFMAaABhAGQAbwB3AGMAbwBwAHkAIAB8ACAARgBvAHIARQBhAGMAaAAtAE8AYgBqAGUAYwB0ACAAewAkAF8ALgBEAGUAbABlAHQAZQAoACkAOwB9AA==2⤵
- Modifies data under HKEY_USERS
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1328
-
-
C:\Windows\system32\wbem\unsecapp.exeC:\Windows\system32\wbem\unsecapp.exe -Embedding1⤵PID:920
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
PID:1088