Analysis
- max time kernel
162s - max time network
182s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
21/02/2022, 11:15
Static task
static1
Behavioral task
behavioral1
Sample
appraisal.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
appraisal.exe
Resource
win10v2004-en-20220112
windows10-2004_x64
0 signatures
0 seconds
Behavioral task
behavioral3
Sample
property.exe
Resource
win7-en-20211208
windows7_x64
0 signatures
0 seconds
General
- Target property.exe
- Size 715KB
- Sample220221-ncppmsahgj
- SHA256 0ad637fd2f6be43b412315027c0e2636329b7da0f51a40e80e9ad8c76558bb6b
- MD5 a7ce2f883660a89695ae17ce9c60a7dc
- SHA1 d1d38d629f7d86d854efef65eb81635e4ab5d9f0
- SHA512 b4158764b854f291e83bd47938b64e69029e63dc2f7bb96fc7ae11f3d9895109193e9ee0a2b2aee7d6d0b4022a38d2560cab4393609b58734326971cbd915031
- MD5 SHA1 SHA512
Malware Config
Signatures
- NetWire RAT payload 1 IoCs
resource yara_rule behavioral4/memory/484-131-0x0000000000400000-0x0000000000433000-memory.dmp netwire - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3816 set thread context of 484 3816 property.exe 62 - Drops file in Windows directory 3 IoCs
description ioc Process File opened for modification C:\Windows\WinSxS\pending.xml TiWorker.exe File opened for modification C:\Windows\ServiceProfiles\NetworkService\AppData\Local\Microsoft\Windows\DeliveryOptimization\State\keyValueLKG.dat svchost.exe File opened for modification C:\Windows\Logs\CBS\CBS.log TiWorker.exe - Modifies data under HKEY_USERS 49 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthlyUploadRestriction = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4088" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CDNConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\GroupConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PeerInfoCount = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "0.322322" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\SwarmCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LANConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\InternetConnectionCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkUsageBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Settings svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DownloadMode_BackCompat = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateBkCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\KVFileExpirationTime = "132901202234729670" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\Geo_EndpointFullUri = "https://geo.prod.do.dsp.mp.microsoft.com/geo" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\LinkLocalConnectionCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\DODownloadMode = "1" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MemoryUsageKB = "4284" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "20.006786" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\PriorityDownloadPendingCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\MonthID = "2" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config\GeoVersion_EndpointFullUri = "https://geover.prod.do.dsp.mp.microsoft.com/geoversion" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UplinkUsageBps = "0" svchost.exe Set value (str) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CPUpct = "11.535599" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyInternetBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCdnBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLinkLocalBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyGroupBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyRateFrCnt = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\CacheSizeBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadCount = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\NormalDownloadPendingCount = "0" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Config svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyLanBytes = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownlinkBps = "0" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\FrDownloadRatePct = "90" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\BkDownloadRatePct = "45" svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\UploadRatePct = "100" svchost.exe Key created \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage svchost.exe Set value (int) \REGISTRY\USER\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\DeliveryOptimization\Usage\DownloadMonthlyCacheHostBytes = "0" svchost.exe - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 2720 property.exe 3816 property.exe - Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe Token: SeRestorePrivilege 396 TiWorker.exe Token: SeSecurityPrivilege 396 TiWorker.exe Token: SeBackupPrivilege 396 TiWorker.exe - Suspicious use of WriteProcessMemory 10 IoCs
description pid Process procid_target PID 2720 wrote to memory of 3508 2720 property.exe 60 PID 2720 wrote to memory of 3508 2720 property.exe 60 PID 2720 wrote to memory of 3508 2720 property.exe 60 PID 2720 wrote to memory of 3816 2720 property.exe 61 PID 2720 wrote to memory of 3816 2720 property.exe 61 PID 2720 wrote to memory of 3816 2720 property.exe 61 PID 3816 wrote to memory of 484 3816 property.exe 62 PID 3816 wrote to memory of 484 3816 property.exe 62 PID 3816 wrote to memory of 484 3816 property.exe 62 PID 3816 wrote to memory of 484 3816 property.exe 62
Processes
-
C:\Users\Admin\AppData\Local\Temp\property.exe"C:\Users\Admin\AppData\Local\Temp\property.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:2720 -
C:\Users\Admin\AppData\Local\Temp\property.exe"C:\Users\Admin\AppData\Local\Temp\property.exe"2⤵PID:3508
-
-
C:\Users\Admin\AppData\Local\Temp\property.exe"C:\Users\Admin\AppData\Local\Temp\property.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:3816 -
C:\Users\Admin\AppData\Local\Temp\property.exe"C:\Users\Admin\AppData\Local\Temp\property.exe"3⤵PID:484
-
-
-
C:\Windows\System32\svchost.exeC:\Windows\System32\svchost.exe -k NetworkService -p1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
PID:2628
-
C:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exeC:\Windows\winsxs\amd64_microsoft-windows-servicingstack_31bf3856ad364e35_10.0.19041.1220_none_7e21bc567c7ed16b\TiWorker.exe -Embedding1⤵
- Drops file in Windows directory
- Suspicious use of AdjustPrivilegeToken
PID:396