Analysis
-
max time kernel
160s -
max time network
167s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
01-07-2022 05:28
Static task
static1
Behavioral task
behavioral1
Sample
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe
Resource
win7-20220414-en
General
-
Target
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe
-
Size
620KB
-
MD5
9d61337a7076d907d0a5282003adf16c
-
SHA1
62a7d89391337e8e52d65efa4d2456e7d28a2cdf
-
SHA256
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d
-
SHA512
674df81e9201dc39d215b1991fda1c9b41cc04a0fb4be307611d3637089e0fe49bceefe9a402ee9155e313a985359eadb461da9f86327773bbf8b0d66cc68f80
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\WPA Service = "C:\\Program Files (x86)\\WPA Service\\wpasv.exe" ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription ioc process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription pid process target process PID 756 set thread context of 4372 756 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Drops file in Program Files directory 2 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription ioc process File created C:\Program Files (x86)\WPA Service\wpasv.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe File opened for modification C:\Program Files (x86)\WPA Service\wpasv.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Creates scheduled task(s) 1 TTPs 2 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
Processes:
schtasks.exeschtasks.exepid process 4208 schtasks.exe 3468 schtasks.exe -
Suspicious behavior: EnumeratesProcesses 3 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exepid process 4372 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe 4372 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe 4372 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exepid process 4372 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription pid process Token: SeDebugPrivilege 4372 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exepid process 756 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exeff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exedescription pid process target process PID 756 wrote to memory of 4372 756 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe PID 756 wrote to memory of 4372 756 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe PID 756 wrote to memory of 4372 756 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe PID 4372 wrote to memory of 4208 4372 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 4372 wrote to memory of 4208 4372 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 4372 wrote to memory of 4208 4372 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 4372 wrote to memory of 3468 4372 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 4372 wrote to memory of 3468 4372 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe PID 4372 wrote to memory of 3468 4372 ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe schtasks.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe"C:\Users\Admin\AppData\Local\Temp\ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exeC:\Users\Admin\AppData\Local\Temp\ff6e9f1b64ba5d0c4994921a56321c3026f655b01614e2d16c84edd75be51b8d.exe"2⤵
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops file in Program Files directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Service" /xml "C:\Users\Admin\AppData\Local\Temp\tmpDC37.tmp"3⤵
- Creates scheduled task(s)
-
C:\Windows\SysWOW64\schtasks.exe"schtasks.exe" /create /f /tn "WPA Service Task" /xml "C:\Users\Admin\AppData\Local\Temp\tmpE7C1.tmp"3⤵
- Creates scheduled task(s)
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\tmpDC37.tmpFilesize
1KB
MD5074ac67209d1fbaf78e7690cc1da55d9
SHA15726985e8fc4ca059050416fcc5c9ebec1e9d90a
SHA256b32ba0b8821eef5b57298296c8c8bdf394fb6ec238057c22fa07b10f877862bf
SHA512cd50dd0efda9af57aaf4ea6c86afd863054367a3a265f36a5cbfc8427da3c684c725e999f632f2b98060c85c07e289c81759fddac99d23ecd92c8f832c135a5e
-
C:\Users\Admin\AppData\Local\Temp\tmpE7C1.tmpFilesize
1KB
MD521de6c3a6440d917bdbb4b491191d9b2
SHA1c63c300affe7147910dc4544d2d5f3029bf321a6
SHA25623af17733a3882cdd82a5bbc321d896b2430dc1bb4b4ac034d129cde5027afc4
SHA512dcd1c464ed36593b990e072940ab415804ef8076743015fff4939211e30e436beb7ce6af3072769abe0214f737cedb210d2b45e6e90da20dac54c3945b11575f
-
memory/756-141-0x00007FFA17D50000-0x00007FFA17F45000-memory.dmpFilesize
2.0MB
-
memory/756-134-0x0000000002260000-0x0000000002267000-memory.dmpFilesize
28KB
-
memory/756-135-0x0000000077470000-0x0000000077613000-memory.dmpFilesize
1.6MB
-
memory/756-136-0x00007FFA17D50000-0x00007FFA17F45000-memory.dmpFilesize
2.0MB
-
memory/756-132-0x0000000002260000-0x0000000002267000-memory.dmpFilesize
28KB
-
memory/3468-148-0x0000000000000000-mapping.dmp
-
memory/4208-146-0x0000000000000000-mapping.dmp
-
memory/4372-140-0x0000000077470000-0x0000000077613000-memory.dmpFilesize
1.6MB
-
memory/4372-142-0x00000000005D0000-0x00000000005D7000-memory.dmpFilesize
28KB
-
memory/4372-143-0x0000000077470000-0x0000000077613000-memory.dmpFilesize
1.6MB
-
memory/4372-144-0x0000000074AE0000-0x0000000075091000-memory.dmpFilesize
5.7MB
-
memory/4372-145-0x0000000074AE0000-0x0000000075091000-memory.dmpFilesize
5.7MB
-
memory/4372-139-0x00007FFA17D50000-0x00007FFA17F45000-memory.dmpFilesize
2.0MB
-
memory/4372-138-0x0000000000400000-0x00000000004A2000-memory.dmpFilesize
648KB
-
memory/4372-137-0x0000000000400000-0x0000000000451000-memory.dmpFilesize
324KB
-
memory/4372-133-0x0000000000000000-mapping.dmp