Analysis
-
max time kernel
150s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220718-en -
resource tags
arch:x64arch:x86image:win7-20220718-enlocale:en-usos:windows7-x64system -
submitted
24-07-2022 14:28
Static task
static1
Behavioral task
behavioral1
Sample
835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe
Resource
win7-20220718-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe
-
Size
678KB
-
MD5
2aee32c7d122a76eb0aeb622c0fd63a1
-
SHA1
85fe028305d01afff1885cf977121b3dd7b7207f
-
SHA256
835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b
-
SHA512
e12fd3e866c823a995d0736a64a7063a2eee9e9d7cafd9fc5559165d952b098c944c48413d8a28a87d22fdab71490c90697752cdadaa5f7cdb78747ee18f12dc
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Test = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Library\\835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Users\Admin\Documents\desktop.ini 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Users\Admin\Desktop\desktop.ini 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\iasrecst.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File opened for modification C:\Windows\SysWOW64\mfc100esn.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\nshipsec.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\WcsPlugInService.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\xpsservices.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\FXSCOM.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\KBDROST.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\PeerDistSh.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\chkntfs.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\api-ms-win-crt-process-l1-1-0.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\WsmSvc.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\DeviceDisplayStatusManager.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\KBDCA.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\KBDTUF.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\localsec.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File opened for modification C:\Windows\SysWOW64\vcamp110.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\sort.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\dsdmo.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File opened for modification C:\Windows\SysWOW64\vcamp140.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\ws2help.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\wsnmp32.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\dnscacheugc.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\WPDShextAutoplay.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\CertEnrollUI.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\KBDIT142.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\odbctrac.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\wmdrmsdk.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\taskschd.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\TSChannel.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\dxtmsft.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\Faultrep.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\jscript9.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File opened for modification C:\Windows\SysWOW64\msvcr100.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\msxml6r.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\ndfhcdiscovery.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\VIDRESZR.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\wcnwiz.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\davclnt.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\NlsLexicons0416.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\SortWindows6Compat.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\drttransport.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\hcproviders.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\Magnification.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\PSHED.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\winbrand.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\storage.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\WlS0WndH.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\mfps.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\NaturalLanguage6.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\NlsData000d.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\NlsData0039.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\NlsLexicons0027.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\sas.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\KBDBGPH1.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\KBDINPUN.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\softkbd.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\werui.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\cacls.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\gpresult.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\taskkill.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\api-ms-win-crt-heap-l1-1-0.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\profapi.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\wdscore.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\drmmgrtn.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1752 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe"C:\Users\Admin\AppData\Local\Temp\835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1752
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:1592