Analysis
-
max time kernel
150s -
max time network
125s -
platform
windows10-2004_x64 -
resource
win10v2004-20220721-en -
resource tags
arch:x64arch:x86image:win10v2004-20220721-enlocale:en-usos:windows10-2004-x64system -
submitted
24-07-2022 14:28
Static task
static1
Behavioral task
behavioral1
Sample
835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe
Resource
win7-20220718-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe
Resource
win10v2004-20220721-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe
-
Size
678KB
-
MD5
2aee32c7d122a76eb0aeb622c0fd63a1
-
SHA1
85fe028305d01afff1885cf977121b3dd7b7207f
-
SHA256
835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b
-
SHA512
e12fd3e866c823a995d0736a64a7063a2eee9e9d7cafd9fc5559165d952b098c944c48413d8a28a87d22fdab71490c90697752cdadaa5f7cdb78747ee18f12dc
Score
10/10
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Test = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Library\\835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created C:\Users\Admin\Desktop\desktop.ini 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Users\Admin\Documents\desktop.ini 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Drops file in System32 directory 64 IoCs
description ioc Process File created C:\Windows\SysWOW64\agentactivationruntimestarter.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\AtBroker.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\printui.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\mfsensorgroup.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\wtsapi32.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\enrollmentapi.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\fdSSDP.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File opened for modification C:\Windows\SysWOW64\mfc140esn.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\msls31.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\regapi.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\rtffilt.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\winrnr.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\riched20.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\Winlangdb.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\AcSpecfc.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\shacct.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\RMActivate.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\kbdnec95.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\odfox32.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\Windows.Media.Ocr.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\bitsadmin.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\hdwwiz.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\KBDNO.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\KBDTUF.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\spbcd.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\ssdm.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\Windows.UI.Input.Inking.Analysis.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\dmcompos.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\dmiso8601utils.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\jscript9diag.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\LicensingWinRT.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\mmgaproxystub.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\KBDGR.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\powercpl.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\PerceptionDevice.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\fltMC.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\GamePanelExternalHook.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\IndexedDbLegacy.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\KBDBR.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\KBDTH0.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File opened for modification C:\Windows\SysWOW64\mfc110chs.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\MP3DMOD.DLL 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\ReInfo.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\usbceip.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\Windows.Media.MediaControl.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\Windows.System.Profile.HardwareId.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\wusa.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\aadWamExtension.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\comsvcs.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\ErrorDetails.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\ieframe.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\netprofm.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\wlancfg.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\dot3gpui.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\joinproviderol.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\netcenter.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\RstrtMgr.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\secproc_ssp_isv.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\SortServer2003Compat.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\Windows.Networking.Connectivity.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\wlanui.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\gpupdate.exe 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\rasmontr.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe File created C:\Windows\SysWOW64\dmusic.dll 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1660 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe -
System policy modification 1 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" 835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe"C:\Users\Admin\AppData\Local\Temp\835fce14e9e8a1024d0a220442bb7d48a0db8730317c84e91bde48cb6ee0603b.exe"1⤵
- UAC bypass
- Adds Run key to start application
- Checks whether UAC is enabled
- Drops desktop.ini file(s)
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- System policy modification
PID:1660
-
C:\Windows\explorer.exeexplorer.exe1⤵PID:4604