Analysis
-
max time kernel
152s -
max time network
147s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 05:02
Behavioral task
behavioral1
Sample
63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe
Resource
win7-20220414-en
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe
Resource
win10v2004-20220414-en
0 signatures
0 seconds
General
-
Target
63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe
-
Size
29KB
-
MD5
e9c813c3c14c5bd4fd33874348a5669c
-
SHA1
aebbdbf53a56e08dcbce4ac62cfebc299968a710
-
SHA256
63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04
-
SHA512
72d0ffb7cd3d24739e9627c6265ccfddbb8b7531c62ee03512bdddaac12517d10d6aa439de7b52c1f99f93c28a22a5aabab6b1d16120acbbf80e8036e86a1e58
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\589efcb4729236d78cc774c0c6b1714f.exe 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\589efcb4729236d78cc774c0c6b1714f.exe 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\589efcb4729236d78cc774c0c6b1714f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe\" .." 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\589efcb4729236d78cc774c0c6b1714f = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe\" .." 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe -
Suspicious behavior: EnumeratesProcesses 48 IoCs
Processes:
63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exepid process 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exedescription pid process Token: SeDebugPrivilege 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exedescription pid process target process PID 4532 wrote to memory of 2576 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe netsh.exe PID 4532 wrote to memory of 2576 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe netsh.exe PID 4532 wrote to memory of 2576 4532 63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe"C:\Users\Admin\AppData\Local\Temp\63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe" "63cedc737425f8bdf00c623c8f6dc88dfb8abb44b0a138805716166b3f323a04.exe" ENABLE2⤵