Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
20-05-2022 18:06
Behavioral task
behavioral1
Sample
c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe
Resource
win10v2004-20220414-en
General
-
Target
c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe
-
Size
37KB
-
MD5
c3f164e066b7f20fffd8df364fc40266
-
SHA1
85133f66865acaf84901e93a18477277497ee725
-
SHA256
c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7
-
SHA512
1cc683df9225a6588011f28942762030f0d94ba36fe4226447e7e0f46c5dc15231d274000695df35cdba4094612a1adb07c688cdd67aadc7070299af45f73a29
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs
-
Drops startup file 2 IoCs
Processes:
c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b3606c5f97d6501fbc87e008a24eb48c.exe c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\b3606c5f97d6501fbc87e008a24eb48c.exe c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1809750270-3141839489-3074374771-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\b3606c5f97d6501fbc87e008a24eb48c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe\" .." c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\b3606c5f97d6501fbc87e008a24eb48c = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe\" .." c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe -
Drops autorun.inf file 1 TTPs
Malware can abuse Windows Autorun to spread further via attached volumes.
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exepid process 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exepid process 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exedescription pid process Token: SeDebugPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: 33 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe Token: SeIncBasePriorityPrivilege 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exedescription pid process target process PID 2160 wrote to memory of 4964 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe netsh.exe PID 2160 wrote to memory of 4964 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe netsh.exe PID 2160 wrote to memory of 4964 2160 c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe netsh.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe"C:\Users\Admin\AppData\Local\Temp\c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe" "c057b20168f138304c491aad769453c92851c3b119662715c49b8ae66881d3d7.exe" ENABLE2⤵