Overview
overview
10Static
static
10001.exe
windows7_x64
10001.exe
windows10-2004_x64
101488.exe
windows7_x64
101488.exe
windows10-2004_x64
11_cr.exe
windows7_x64
51_cr.exe
windows10-2004_x64
41cr.exe
windows7_x64
101cr.exe
windows10-2004_x64
41fc2d.exe
windows7_x64
101fc2d.exe
windows10-2004_x64
106e7_2021-0...04.exe
windows7_x64
106e7_2021-0...04.exe
windows10-2004_x64
10Abjects.exe
windows7_x64
1Abjects.exe
windows10-2004_x64
4BattleText.exe
windows7_x64
10BattleText.exe
windows10-2004_x64
1HANS.exe
windows7_x64
3HANS.exe
windows10-2004_x64
1Hulu.exe
windows7_x64
8Hulu.exe
windows10-2004_x64
8IntelFIVE.exe
windows7_x64
3IntelFIVE.exe
windows10-2004_x64
7IntelFOUR.exe
windows7_x64
3IntelFOUR.exe
windows10-2004_x64
7IntelONE.exe
windows7_x64
3IntelONE.exe
windows10-2004_x64
7IntelTHREE.exe
windows7_x64
3IntelTHREE.exe
windows10-2004_x64
7IntelTWO.exe
windows7_x64
3IntelTWO.exe
windows10-2004_x64
7Lucky_Fixed.exe
windows7_x64
3Lucky_Fixed.exe
windows10-2004_x64
10Resubmissions
07-02-2022 00:34
220207-aw81qsdce2 10Analysis
-
max time kernel
163s -
max time network
206s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
07-02-2022 00:34
Behavioral task
behavioral1
Sample
001.exe
Resource
win7-en-20211208
Behavioral task
behavioral2
Sample
001.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral3
Sample
1488.exe
Resource
win7-en-20211208
Behavioral task
behavioral4
Sample
1488.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral5
Sample
1_cr.exe
Resource
win7-en-20211208
Behavioral task
behavioral6
Sample
1_cr.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral7
Sample
1cr.exe
Resource
win7-en-20211208
Behavioral task
behavioral8
Sample
1cr.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral9
Sample
1fc2d.exe
Resource
win7-en-20211208
Behavioral task
behavioral10
Sample
1fc2d.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral11
Sample
6e7_2021-01-19_18-04.exe
Resource
win7-en-20211208
Behavioral task
behavioral12
Sample
6e7_2021-01-19_18-04.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral13
Sample
Abjects.exe
Resource
win7-en-20211208
Behavioral task
behavioral14
Sample
Abjects.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral15
Sample
BattleText.exe
Resource
win7-en-20211208
Behavioral task
behavioral16
Sample
BattleText.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral17
Sample
HANS.exe
Resource
win7-en-20211208
Behavioral task
behavioral18
Sample
HANS.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral19
Sample
Hulu.exe
Resource
win7-en-20211208
Behavioral task
behavioral20
Sample
Hulu.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral21
Sample
IntelFIVE.exe
Resource
win7-en-20211208
Behavioral task
behavioral22
Sample
IntelFIVE.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral23
Sample
IntelFOUR.exe
Resource
win7-en-20211208
Behavioral task
behavioral24
Sample
IntelFOUR.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral25
Sample
IntelONE.exe
Resource
win7-en-20211208
Behavioral task
behavioral26
Sample
IntelONE.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral27
Sample
IntelTHREE.exe
Resource
win7-en-20211208
Behavioral task
behavioral28
Sample
IntelTHREE.exe
Resource
win10v2004-en-20220113
Behavioral task
behavioral29
Sample
IntelTWO.exe
Resource
win7-en-20211208
Behavioral task
behavioral30
Sample
IntelTWO.exe
Resource
win10v2004-en-20220112
Behavioral task
behavioral31
Sample
Lucky_Fixed.exe
Resource
win7-en-20211208
Behavioral task
behavioral32
Sample
Lucky_Fixed.exe
Resource
win10v2004-en-20220112
General
-
Target
Abjects.exe
-
Size
51KB
-
MD5
ce328046ab3836eef7177159d6e080af
-
SHA1
596a87e18b4d9789c6fd167ac90036560f4382bc
-
SHA256
f14535ebeec9ecd43865283cdbdcf4a29548055d64977da1d07255dd8bf00edf
-
SHA512
27edd18f8f14b63f4ff62ebb0c856590dd7c255fd8d1c025d0ab547761dc7b486b8dc559443ea324ada54019f17e11917fb1712eaa9de53797cb09f61b7db0a2
Malware Config
Signatures
-
Drops file in Windows directory 6 IoCs
description ioc Process File opened for modification C:\Windows\SoftwareDistribution\ReportingEvents.log svchost.exe File opened for modification C:\Windows\WindowsUpdate.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.chk svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\Logs\edb.log svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.edb svchost.exe File opened for modification C:\Windows\SoftwareDistribution\DataStore\DataStore.jfm svchost.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
description pid Process Token: SeDebugPrivilege 3588 Abjects.exe Token: SeShutdownPrivilege 4700 svchost.exe Token: SeCreatePagefilePrivilege 4700 svchost.exe Token: SeShutdownPrivilege 4700 svchost.exe Token: SeCreatePagefilePrivilege 4700 svchost.exe Token: SeShutdownPrivilege 4700 svchost.exe Token: SeCreatePagefilePrivilege 4700 svchost.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\Abjects.exe"C:\Users\Admin\AppData\Local\Temp\Abjects.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
PID:3588
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s wuauserv1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:4700