Analysis
-
max time kernel
43s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
08-07-2022 10:56
Static task
static1
Behavioral task
behavioral1
Sample
Exotic.exe
Resource
win7-20220414-en
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
Exotic.exe
Resource
win10v2004-20220414-en
windows10-2004_x64
0 signatures
0 seconds
General
-
Target
Exotic.exe
-
Size
7.3MB
-
MD5
5677e0d59fea82ee3429ce9c4e8134a4
-
SHA1
80e74985ff0e651a9cd18298614fa0994cb6c183
-
SHA256
0f0ec79102ad1d811ab4f978214b43703aa8542f3815629b830c5aa520de5ad7
-
SHA512
5e649c4886fedb75f1f4d5751fafc78557669c6a0d885ff2ff8dce530ef3dd19059d809c3ca284b25773de01fc83fc4009ef38c394eec0d2db2165a737679341
Score
6/10
Malware Config
Signatures
-
Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum Exotic.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\Disk\Enum\0 Exotic.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1644 wmic.exe Token: SeSecurityPrivilege 1644 wmic.exe Token: SeTakeOwnershipPrivilege 1644 wmic.exe Token: SeLoadDriverPrivilege 1644 wmic.exe Token: SeSystemProfilePrivilege 1644 wmic.exe Token: SeSystemtimePrivilege 1644 wmic.exe Token: SeProfSingleProcessPrivilege 1644 wmic.exe Token: SeIncBasePriorityPrivilege 1644 wmic.exe Token: SeCreatePagefilePrivilege 1644 wmic.exe Token: SeBackupPrivilege 1644 wmic.exe Token: SeRestorePrivilege 1644 wmic.exe Token: SeShutdownPrivilege 1644 wmic.exe Token: SeDebugPrivilege 1644 wmic.exe Token: SeSystemEnvironmentPrivilege 1644 wmic.exe Token: SeRemoteShutdownPrivilege 1644 wmic.exe Token: SeUndockPrivilege 1644 wmic.exe Token: SeManageVolumePrivilege 1644 wmic.exe Token: 33 1644 wmic.exe Token: 34 1644 wmic.exe Token: 35 1644 wmic.exe Token: SeIncreaseQuotaPrivilege 1644 wmic.exe Token: SeSecurityPrivilege 1644 wmic.exe Token: SeTakeOwnershipPrivilege 1644 wmic.exe Token: SeLoadDriverPrivilege 1644 wmic.exe Token: SeSystemProfilePrivilege 1644 wmic.exe Token: SeSystemtimePrivilege 1644 wmic.exe Token: SeProfSingleProcessPrivilege 1644 wmic.exe Token: SeIncBasePriorityPrivilege 1644 wmic.exe Token: SeCreatePagefilePrivilege 1644 wmic.exe Token: SeBackupPrivilege 1644 wmic.exe Token: SeRestorePrivilege 1644 wmic.exe Token: SeShutdownPrivilege 1644 wmic.exe Token: SeDebugPrivilege 1644 wmic.exe Token: SeSystemEnvironmentPrivilege 1644 wmic.exe Token: SeRemoteShutdownPrivilege 1644 wmic.exe Token: SeUndockPrivilege 1644 wmic.exe Token: SeManageVolumePrivilege 1644 wmic.exe Token: 33 1644 wmic.exe Token: 34 1644 wmic.exe Token: 35 1644 wmic.exe Token: SeIncreaseQuotaPrivilege 1828 wmic.exe Token: SeSecurityPrivilege 1828 wmic.exe Token: SeTakeOwnershipPrivilege 1828 wmic.exe Token: SeLoadDriverPrivilege 1828 wmic.exe Token: SeSystemProfilePrivilege 1828 wmic.exe Token: SeSystemtimePrivilege 1828 wmic.exe Token: SeProfSingleProcessPrivilege 1828 wmic.exe Token: SeIncBasePriorityPrivilege 1828 wmic.exe Token: SeCreatePagefilePrivilege 1828 wmic.exe Token: SeBackupPrivilege 1828 wmic.exe Token: SeRestorePrivilege 1828 wmic.exe Token: SeShutdownPrivilege 1828 wmic.exe Token: SeDebugPrivilege 1828 wmic.exe Token: SeSystemEnvironmentPrivilege 1828 wmic.exe Token: SeRemoteShutdownPrivilege 1828 wmic.exe Token: SeUndockPrivilege 1828 wmic.exe Token: SeManageVolumePrivilege 1828 wmic.exe Token: 33 1828 wmic.exe Token: 34 1828 wmic.exe Token: 35 1828 wmic.exe Token: SeIncreaseQuotaPrivilege 1828 wmic.exe Token: SeSecurityPrivilege 1828 wmic.exe Token: SeTakeOwnershipPrivilege 1828 wmic.exe Token: SeLoadDriverPrivilege 1828 wmic.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 536 wrote to memory of 896 536 Exotic.exe 28 PID 536 wrote to memory of 896 536 Exotic.exe 28 PID 536 wrote to memory of 896 536 Exotic.exe 28 PID 536 wrote to memory of 1644 536 Exotic.exe 30 PID 536 wrote to memory of 1644 536 Exotic.exe 30 PID 536 wrote to memory of 1644 536 Exotic.exe 30 PID 536 wrote to memory of 1828 536 Exotic.exe 33 PID 536 wrote to memory of 1828 536 Exotic.exe 33 PID 536 wrote to memory of 1828 536 Exotic.exe 33 PID 536 wrote to memory of 468 536 Exotic.exe 35 PID 536 wrote to memory of 468 536 Exotic.exe 35 PID 536 wrote to memory of 468 536 Exotic.exe 35 PID 536 wrote to memory of 1576 536 Exotic.exe 37 PID 536 wrote to memory of 1576 536 Exotic.exe 37 PID 536 wrote to memory of 1576 536 Exotic.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\Exotic.exe"C:\Users\Admin\AppData\Local\Temp\Exotic.exe"1⤵
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:536 -
C:\Windows\system32\hostname.exehostname2⤵PID:896
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get uuid2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1644
-
-
C:\Windows\System32\Wbem\wmic.exewmic ComputerSystem get TotalPhysicalMemory2⤵
- Suspicious use of AdjustPrivilegeToken
PID:1828
-
-
C:\Windows\System32\Wbem\wmic.exewmic logicaldisk where Caption="C:" get Size2⤵PID:468
-
-
C:\Windows\System32\Wbem\wmic.exewmic cpu get NumberOfCores2⤵PID:1576
-