Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
22-06-2022 08:10
Static task
static1
Behavioral task
behavioral1
Sample
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe
Resource
win10v2004-20220414-en
General
-
Target
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe
-
Size
769KB
-
MD5
54f329e755ead912faa7b0223e256fe8
-
SHA1
9077aa1adb4c64577ac8abb444f46466e1c15234
-
SHA256
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257
-
SHA512
0513e3c3c0fdc91ccdb1a6055c5148c48477f09ab281d5f7b72cb4278889ee037ecebaf667da44156d99de280e028f3673edade9fbdf986d3843642d4c054fc2
Malware Config
Signatures
-
Obfuscated with Agile.Net obfuscator 1 IoCs
Detects use of the Agile.Net commercial obfuscator, which is capable of entity renaming and control flow obfuscation.
Processes:
resource yara_rule behavioral1/memory/1224-55-0x0000000000300000-0x0000000000320000-memory.dmp agile_net -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\winzip\\Services.exe" 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe Set value (str) \REGISTRY\USER\S-1-5-21-1083475884-596052423-1669053738-1000\Software\Microsoft\Windows\CurrentVersion\Run\Services = "\\winzip\\Services.exe" 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exedescription pid Process procid_target PID 1224 set thread context of 968 1224 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 28 -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exedescription pid Process Token: SeDebugPrivilege 1224 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe Token: SeDebugPrivilege 968 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe Token: 33 968 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe Token: SeIncBasePriorityPrivilege 968 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exepid Process 968 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exedescription pid Process procid_target PID 1224 wrote to memory of 968 1224 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 28 PID 1224 wrote to memory of 968 1224 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 28 PID 1224 wrote to memory of 968 1224 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 28 PID 1224 wrote to memory of 968 1224 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 28 PID 1224 wrote to memory of 968 1224 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 28 PID 1224 wrote to memory of 968 1224 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 28 PID 1224 wrote to memory of 968 1224 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 28 PID 1224 wrote to memory of 968 1224 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 28 PID 1224 wrote to memory of 968 1224 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe"C:\Users\Admin\AppData\Local\Temp\2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1224 -
C:\Users\Admin\AppData\Local\Temp\2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe"C:\Users\Admin\AppData\Local\Temp\2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe"2⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:968
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:684