Analysis
- max time kernel
4294212s - max time network
156s - platform
windows7_x64 - resource
win7-20220310-en - submitted
18/03/2022, 14:36
Static task
static1
Behavioral task
behavioral1
Sample
c0abec41705b4bdd837daf0df85f53ca.exe
Resource
win7-20220310-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
c0abec41705b4bdd837daf0df85f53ca.exe
Resource
win10v2004-en-20220113
windows10-2004_x64
0 signatures
0 seconds
General
- Target c0abec41705b4bdd837daf0df85f53ca.exe
- Size 103KB
- Sample220318-rylfwsaed7
- SHA256 7cc4f1580d6f425b3025bdb83a4782bea363f6d8c1c7fa6374e159aa06327ca2
- MD5 c0abec41705b4bdd837daf0df85f53ca
- SHA1 02c5f31aa6e280bdd7f2bfcf35fc863a735380e1
- SHA512 7a30725213b50f20dc683ea894ea12c23b97a141aab54881d42191209e0044f584e739c1454533148880347fbfd13c25b6a6a732663870516f885ef289ce08e8
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Modifies Windows Firewall 1 TTPs
- Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1f4e92fbfae203cc3d0fa75e24979e94.exe c0abec41705b4bdd837daf0df85f53ca.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1f4e92fbfae203cc3d0fa75e24979e94.exe c0abec41705b4bdd837daf0df85f53ca.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1f4e92fbfae203cc3d0fa75e24979e94 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c0abec41705b4bdd837daf0df85f53ca.exe\" .." c0abec41705b4bdd837daf0df85f53ca.exe Set value (str) \REGISTRY\USER\S-1-5-21-2932610838-281738825-1127631353-1000\Software\Microsoft\Windows\CurrentVersion\Run\1f4e92fbfae203cc3d0fa75e24979e94 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c0abec41705b4bdd837daf0df85f53ca.exe\" .." c0abec41705b4bdd837daf0df85f53ca.exe - Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
- Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe 1744 c0abec41705b4bdd837daf0df85f53ca.exe - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1744 c0abec41705b4bdd837daf0df85f53ca.exe - Suspicious use of AdjustPrivilegeToken 33 IoCs
description pid Process Token: SeDebugPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: 33 1744 c0abec41705b4bdd837daf0df85f53ca.exe Token: SeIncBasePriorityPrivilege 1744 c0abec41705b4bdd837daf0df85f53ca.exe - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1744 wrote to memory of 1828 1744 c0abec41705b4bdd837daf0df85f53ca.exe 27 PID 1744 wrote to memory of 1828 1744 c0abec41705b4bdd837daf0df85f53ca.exe 27 PID 1744 wrote to memory of 1828 1744 c0abec41705b4bdd837daf0df85f53ca.exe 27 PID 1744 wrote to memory of 1828 1744 c0abec41705b4bdd837daf0df85f53ca.exe 27
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0abec41705b4bdd837daf0df85f53ca.exe"C:\Users\Admin\AppData\Local\Temp\c0abec41705b4bdd837daf0df85f53ca.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\c0abec41705b4bdd837daf0df85f53ca.exe" "c0abec41705b4bdd837daf0df85f53ca.exe" ENABLE2⤵PID:1828
-