Analysis
-
max time kernel
151s -
max time network
149s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
15/09/2022, 11:06
Behavioral task
behavioral1
Sample
013a54d88cabf8dd0afb664b6f1b06b7.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
013a54d88cabf8dd0afb664b6f1b06b7.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
013a54d88cabf8dd0afb664b6f1b06b7.exe
-
Size
37KB
-
MD5
013a54d88cabf8dd0afb664b6f1b06b7
-
SHA1
99431f171ef84bbae20376a787135578a61f235f
-
SHA256
f0aa0de7d31f68b412ddb78d8a0ffe9153422133780522a945eb17b5bd1016f0
-
SHA512
f5e21e058ce8569e764b8ddbf0f6b6b28b1c4aa913fec25e09e377786a321ac742a631eab39b3d7e0b5794d9a9b6ffdc7b52d585a0560b8d4eb2683fac0aeabd
-
SSDEEP
384:w+xcaCisP/WRdL5kyc/5kvHHng6sZ8UrAF+rMRTyN/0L+EcoinblneHQM3epzX0t:FxckD5nc/5k/VsxrM+rMRa8NuCnt
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 1520 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ec006a1393be728faf6cd0946d4a116.exe 013a54d88cabf8dd0afb664b6f1b06b7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ec006a1393be728faf6cd0946d4a116.exe 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\1ec006a1393be728faf6cd0946d4a116 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\013a54d88cabf8dd0afb664b6f1b06b7.exe\" .." 013a54d88cabf8dd0afb664b6f1b06b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1ec006a1393be728faf6cd0946d4a116 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\013a54d88cabf8dd0afb664b6f1b06b7.exe\" .." 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf 013a54d88cabf8dd0afb664b6f1b06b7.exe File opened for modification C:\autorun.inf 013a54d88cabf8dd0afb664b6f1b06b7.exe File created D:\autorun.inf 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Kills process with taskkill 1 IoCs
pid Process 240 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
description pid Process Token: SeDebugPrivilege 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeDebugPrivilege 240 taskkill.exe Token: 33 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1520 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 27 PID 1672 wrote to memory of 1520 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 27 PID 1672 wrote to memory of 1520 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 27 PID 1672 wrote to memory of 1520 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 27 PID 1672 wrote to memory of 240 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 29 PID 1672 wrote to memory of 240 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 29 PID 1672 wrote to memory of 240 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 29 PID 1672 wrote to memory of 240 1672 013a54d88cabf8dd0afb664b6f1b06b7.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\013a54d88cabf8dd0afb664b6f1b06b7.exe"C:\Users\Admin\AppData\Local\Temp\013a54d88cabf8dd0afb664b6f1b06b7.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\013a54d88cabf8dd0afb664b6f1b06b7.exe" "013a54d88cabf8dd0afb664b6f1b06b7.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:1520
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:240
-