Analysis
- max time kernel
119s - max time network
119s - platform
windows10_x64 - resource
win10-en-20211208 - submitted
26/01/2022, 21:16
Static task
static1
Behavioral task
behavioral1
Sample
c06dc33bdf9cddadadd16e5299a51670.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c06dc33bdf9cddadadd16e5299a51670.exe
Resource
win10-en-20211208
windows10_x64
0 signatures
0 seconds
General
- Target c06dc33bdf9cddadadd16e5299a51670.exe
- Size 681KB
- Sample220126-z4gnwsaecj
- SHA256 94ca0af32ea93d62fa355e450747ae9755c5dcd09e7b4186cd5bd04d7fc56565
- MD5 c06dc33bdf9cddadadd16e5299a51670
- SHA1 733335b4b4e736f6678333d8ee1e39bded2feb56
- SHA512 49b5c57258c4c1d4cc2852845c5bc6b84c425730140562eedf34e4ece777fdd6aba7ef08866be09d7d22ecc6d7cdd301871531acccacc927ff3f3710f276f068
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
pid Process 1560 ComputerDefaults.exe - Loads dropped DLL 1 IoCs
pid Process 1560 ComputerDefaults.exe - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2361464256-2201551969-2316606395-1000\Software\Microsoft\Windows\CurrentVersion\Run\Udcyjzsxwg = "C:\\Users\\Admin\\Contacts\\gwxszjycdU.url" c06dc33bdf9cddadadd16e5299a51670.exe - Program crash 1 IoCs
pid pid_target Process procid_target 1804 1092 WerFault.exe 69 - Runs ping.exe 1 TTPs 1 IoCs
pid Process 2844 PING.EXE - Suspicious behavior: EnumeratesProcesses 16 IoCs
pid Process 2776 powershell.exe 2776 powershell.exe 2776 powershell.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe 1804 WerFault.exe - Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 2776 powershell.exe Token: SeRestorePrivilege 1804 WerFault.exe Token: SeBackupPrivilege 1804 WerFault.exe Token: SeDebugPrivilege 1804 WerFault.exe Token: SeIncreaseQuotaPrivilege 2776 powershell.exe Token: SeSecurityPrivilege 2776 powershell.exe Token: SeTakeOwnershipPrivilege 2776 powershell.exe Token: SeLoadDriverPrivilege 2776 powershell.exe Token: SeSystemProfilePrivilege 2776 powershell.exe Token: SeSystemtimePrivilege 2776 powershell.exe Token: SeProfSingleProcessPrivilege 2776 powershell.exe Token: SeIncBasePriorityPrivilege 2776 powershell.exe Token: SeCreatePagefilePrivilege 2776 powershell.exe Token: SeBackupPrivilege 2776 powershell.exe Token: SeRestorePrivilege 2776 powershell.exe Token: SeShutdownPrivilege 2776 powershell.exe Token: SeDebugPrivilege 2776 powershell.exe Token: SeSystemEnvironmentPrivilege 2776 powershell.exe Token: SeRemoteShutdownPrivilege 2776 powershell.exe Token: SeUndockPrivilege 2776 powershell.exe Token: SeManageVolumePrivilege 2776 powershell.exe Token: 33 2776 powershell.exe Token: 34 2776 powershell.exe Token: 35 2776 powershell.exe Token: 36 2776 powershell.exe - Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1092 2580 c06dc33bdf9cddadadd16e5299a51670.exe 69 PID 2580 wrote to memory of 1136 2580 c06dc33bdf9cddadadd16e5299a51670.exe 71 PID 2580 wrote to memory of 1136 2580 c06dc33bdf9cddadadd16e5299a51670.exe 71 PID 2580 wrote to memory of 1136 2580 c06dc33bdf9cddadadd16e5299a51670.exe 71 PID 1136 wrote to memory of 1936 1136 cmd.exe 73 PID 1136 wrote to memory of 1936 1136 cmd.exe 73 PID 1136 wrote to memory of 1936 1136 cmd.exe 73 PID 1936 wrote to memory of 1560 1936 cmd.exe 76 PID 1936 wrote to memory of 1560 1936 cmd.exe 76 PID 1560 wrote to memory of 1948 1560 ComputerDefaults.exe 77 PID 1560 wrote to memory of 1948 1560 ComputerDefaults.exe 77 PID 1936 wrote to memory of 2844 1936 cmd.exe 79 PID 1936 wrote to memory of 2844 1936 cmd.exe 79 PID 1936 wrote to memory of 2844 1936 cmd.exe 79 PID 1948 wrote to memory of 2776 1948 cmd.exe 80 PID 1948 wrote to memory of 2776 1948 cmd.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\c06dc33bdf9cddadadd16e5299a51670.exe"C:\Users\Admin\AppData\Local\Temp\c06dc33bdf9cddadadd16e5299a51670.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:2580 -
C:\Windows\SysWOW64\DpiScaling.exeC:\Windows\System32\DpiScaling.exe2⤵PID:1092
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1092 -s 4883⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1804
-
-
-
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\Users\Admin\Contacts\Udcyjzsxwgt.bat" "2⤵
- Suspicious use of WriteProcessMemory
PID:1136 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /K C:\Users\Admin\Contacts\UdcyjzsxwgO.bat3⤵
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows \System32\ComputerDefaults.exe"C:\Windows \System32\ComputerDefaults.exe"4⤵
- Executes dropped EXE
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
PID:1560 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c ""C:\windows \system32\KDECO.bat""5⤵
- Suspicious use of WriteProcessMemory
PID:1948 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exepowershell -WindowStyle Hidden -inputformat none -outputformat none -NonInteractive -Command "Add-MpPreference -ExclusionPath 'C:\Users'"6⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2776
-
-
-
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.1 -n 64⤵
- Runs ping.exe
PID:2844
-
-
-