Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
15-09-2022 11:06
Behavioral task
behavioral1
Sample
013a54d88cabf8dd0afb664b6f1b06b7.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
013a54d88cabf8dd0afb664b6f1b06b7.exe
Resource
win10v2004-20220812-en
General
-
Target
013a54d88cabf8dd0afb664b6f1b06b7.exe
-
Size
37KB
-
MD5
013a54d88cabf8dd0afb664b6f1b06b7
-
SHA1
99431f171ef84bbae20376a787135578a61f235f
-
SHA256
f0aa0de7d31f68b412ddb78d8a0ffe9153422133780522a945eb17b5bd1016f0
-
SHA512
f5e21e058ce8569e764b8ddbf0f6b6b28b1c4aa913fec25e09e377786a321ac742a631eab39b3d7e0b5794d9a9b6ffdc7b52d585a0560b8d4eb2683fac0aeabd
-
SSDEEP
384:w+xcaCisP/WRdL5kyc/5kvHHng6sZ8UrAF+rMRTyN/0L+EcoinblneHQM3epzX0t:FxckD5nc/5k/VsxrM+rMRa8NuCnt
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exedescription ioc process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ec006a1393be728faf6cd0946d4a116.exe 013a54d88cabf8dd0afb664b6f1b06b7.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ec006a1393be728faf6cd0946d4a116.exe 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1ec006a1393be728faf6cd0946d4a116 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\013a54d88cabf8dd0afb664b6f1b06b7.exe\" .." 013a54d88cabf8dd0afb664b6f1b06b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1ec006a1393be728faf6cd0946d4a116 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\013a54d88cabf8dd0afb664b6f1b06b7.exe\" .." 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exedescription ioc process File created D:\autorun.inf 013a54d88cabf8dd0afb664b6f1b06b7.exe File created C:\autorun.inf 013a54d88cabf8dd0afb664b6f1b06b7.exe File opened for modification C:\autorun.inf 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 4336 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exepid process 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exepid process 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exetaskkill.exedescription pid process Token: SeDebugPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeDebugPrivilege 4336 taskkill.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exedescription pid process target process PID 4736 wrote to memory of 2200 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe netsh.exe PID 4736 wrote to memory of 2200 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe netsh.exe PID 4736 wrote to memory of 2200 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe netsh.exe PID 4736 wrote to memory of 4336 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe taskkill.exe PID 4736 wrote to memory of 4336 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe taskkill.exe PID 4736 wrote to memory of 4336 4736 013a54d88cabf8dd0afb664b6f1b06b7.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\013a54d88cabf8dd0afb664b6f1b06b7.exe"C:\Users\Admin\AppData\Local\Temp\013a54d88cabf8dd0afb664b6f1b06b7.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\013a54d88cabf8dd0afb664b6f1b06b7.exe" "013a54d88cabf8dd0afb664b6f1b06b7.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken