Analysis
-
max time kernel
150s -
max time network
155s -
platform
windows10-2004_x64 -
resource
win10v2004-en-20220113 -
submitted
20-03-2022 01:32
Static task
static1
Behavioral task
behavioral1
Sample
cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe
Resource
win7-20220310-en
Behavioral task
behavioral2
Sample
cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe
Resource
win10v2004-en-20220113
General
-
Target
cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe
-
Size
10.8MB
-
MD5
4f54150e61b5df07ad6323b964da1a98
-
SHA1
ee32dab0f4489e567ac2da159e1beb68c617c6bd
-
SHA256
cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b
-
SHA512
d4dcc1eaf227030cc94007fc26c839d7d234e050d97dac7aa515f2ab7ecb04db66997381576cbb6287bfd9e2188d65a8cd238a07daa1c9759f582c05c9ef7c1a
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0f089c174b52a60dc1803fc49b6449e2.exe cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\0f089c174b52a60dc1803fc49b6449e2.exe cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1346565761-3498240568-4147300184-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\0f089c174b52a60dc1803fc49b6449e2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe\" .." cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\0f089c174b52a60dc1803fc49b6449e2 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe\" .." cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exedescription pid process Token: SeDebugPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: 33 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe Token: SeIncBasePriorityPrivilege 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exedescription pid process target process PID 868 wrote to memory of 4728 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe netsh.exe PID 868 wrote to memory of 4728 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe netsh.exe PID 868 wrote to memory of 4728 868 cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe"C:\Users\Admin\AppData\Local\Temp\cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe" "cd4805c3292fed3286bc47c43a1384eb633236c720dd2082bc4e897d2788c52b.exe" ENABLE2⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/868-131-0x0000000000610000-0x00000000010EA000-memory.dmpFilesize
10.9MB
-
memory/868-130-0x0000000075060000-0x0000000075810000-memory.dmpFilesize
7.7MB
-
memory/868-132-0x0000000009AA0000-0x000000000A044000-memory.dmpFilesize
5.6MB
-
memory/868-133-0x00000000094F0000-0x0000000009582000-memory.dmpFilesize
584KB
-
memory/868-134-0x0000000009590000-0x000000000962C000-memory.dmpFilesize
624KB
-
memory/868-135-0x0000000005B00000-0x0000000005B01000-memory.dmpFilesize
4KB
-
memory/868-136-0x00000000097A0000-0x00000000097AA000-memory.dmpFilesize
40KB