Analysis
-
max time kernel
132s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
24-02-2022 08:04
Static task
static1
Behavioral task
behavioral1
Sample
good.exe
Resource
win7-20220223-en
General
-
Target
good.exe
-
Size
143KB
-
MD5
b034e2a7cd76b757b7c62ce514b378b4
-
SHA1
27d15f36cb5e3338a19a7f6441ece58439f830f2
-
SHA256
90d3580e187b631a9150bbb4a640b84c6fa990437febdc42f687cc7b3ce1deac
-
SHA512
1cea6503cf244e1efb6ef68994a723f549126fc89ef8a38c76cdcc050d2a4524e96402591d1d150d927a12dcac81084a8275a929cf6e5933fdf62502c9c84385
Malware Config
Signatures
-
Executes dropped EXE 1 IoCs
Processes:
wcfgmgr32.exepid process 2152 wcfgmgr32.exe -
Processes:
resource yara_rule C:\Windows\3049586940303040\wcfgmgr32.exe upx C:\Windows\3049586940303040\wcfgmgr32.exe upx -
Processes:
wcfgmgr32.exedescription ioc process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AutoUpdateDisableNotify = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallDisableNotify = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusOverride = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesOverride = "1" wcfgmgr32.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\FirewallOverride = "1" wcfgmgr32.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
good.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WCfgMgr32 = "C:\\Windows\\3049586940303040\\wcfgmgr32.exe" good.exe Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\WCfgMgr32 = "C:\\Windows\\3049586940303040\\wcfgmgr32.exe" good.exe -
Drops file in Windows directory 3 IoCs
Processes:
good.exedescription ioc process File opened for modification C:\Windows\3049586940303040 good.exe File created C:\Windows\3049586940303040\wcfgmgr32.exe good.exe File opened for modification C:\Windows\3049586940303040\wcfgmgr32.exe good.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
good.exedescription pid process target process PID 364 wrote to memory of 2152 364 good.exe wcfgmgr32.exe PID 364 wrote to memory of 2152 364 good.exe wcfgmgr32.exe PID 364 wrote to memory of 2152 364 good.exe wcfgmgr32.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\good.exe"C:\Users\Admin\AppData\Local\Temp\good.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
-
C:\Windows\3049586940303040\wcfgmgr32.exeC:\Windows\3049586940303040\wcfgmgr32.exe2⤵
- Executes dropped EXE
- Windows security modification
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Windows\3049586940303040\wcfgmgr32.exeMD5
b034e2a7cd76b757b7c62ce514b378b4
SHA127d15f36cb5e3338a19a7f6441ece58439f830f2
SHA25690d3580e187b631a9150bbb4a640b84c6fa990437febdc42f687cc7b3ce1deac
SHA5121cea6503cf244e1efb6ef68994a723f549126fc89ef8a38c76cdcc050d2a4524e96402591d1d150d927a12dcac81084a8275a929cf6e5933fdf62502c9c84385
-
C:\Windows\3049586940303040\wcfgmgr32.exeMD5
b034e2a7cd76b757b7c62ce514b378b4
SHA127d15f36cb5e3338a19a7f6441ece58439f830f2
SHA25690d3580e187b631a9150bbb4a640b84c6fa990437febdc42f687cc7b3ce1deac
SHA5121cea6503cf244e1efb6ef68994a723f549126fc89ef8a38c76cdcc050d2a4524e96402591d1d150d927a12dcac81084a8275a929cf6e5933fdf62502c9c84385
-
memory/364-130-0x0000000002E36000-0x0000000002E3A000-memory.dmpFilesize
16KB
-
memory/364-131-0x0000000002E36000-0x0000000002E3A000-memory.dmpFilesize
16KB
-
memory/364-132-0x0000000000400000-0x0000000000408000-memory.dmpFilesize
32KB
-
memory/2152-135-0x0000000002EF7000-0x0000000002EFA000-memory.dmpFilesize
12KB
-
memory/2152-136-0x0000000002EF7000-0x0000000002EFA000-memory.dmpFilesize
12KB