Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
15-09-2022 11:06
Behavioral task
behavioral1
Sample
013a54d88cabf8dd0afb664b6f1b06b7.exe
Resource
win7-20220901-en
Behavioral task
behavioral2
Sample
013a54d88cabf8dd0afb664b6f1b06b7.exe
Resource
win10v2004-20220812-en
General
-
Target
013a54d88cabf8dd0afb664b6f1b06b7.exe
-
Size
37KB
-
MD5
013a54d88cabf8dd0afb664b6f1b06b7
-
SHA1
99431f171ef84bbae20376a787135578a61f235f
-
SHA256
f0aa0de7d31f68b412ddb78d8a0ffe9153422133780522a945eb17b5bd1016f0
-
SHA512
f5e21e058ce8569e764b8ddbf0f6b6b28b1c4aa913fec25e09e377786a321ac742a631eab39b3d7e0b5794d9a9b6ffdc7b52d585a0560b8d4eb2683fac0aeabd
-
SSDEEP
384:w+xcaCisP/WRdL5kyc/5kvHHng6sZ8UrAF+rMRTyN/0L+EcoinblneHQM3epzX0t:FxckD5nc/5k/VsxrM+rMRa8NuCnt
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 1 IoCs
-
Drops startup file 2 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ec006a1393be728faf6cd0946d4a116.exe 013a54d88cabf8dd0afb664b6f1b06b7.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1ec006a1393be728faf6cd0946d4a116.exe 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\1ec006a1393be728faf6cd0946d4a116 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\013a54d88cabf8dd0afb664b6f1b06b7.exe\" .." 013a54d88cabf8dd0afb664b6f1b06b7.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\1ec006a1393be728faf6cd0946d4a116 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\013a54d88cabf8dd0afb664b6f1b06b7.exe\" .." 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Drops autorun.inf file 1 TTPs 3 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exedescription ioc process File created C:\autorun.inf 013a54d88cabf8dd0afb664b6f1b06b7.exe File opened for modification C:\autorun.inf 013a54d88cabf8dd0afb664b6f1b06b7.exe File created D:\autorun.inf 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Kills process with taskkill 1 IoCs
Processes:
taskkill.exepid process 1164 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exepid process 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exepid process 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Suspicious use of AdjustPrivilegeToken 22 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exetaskkill.exedescription pid process Token: SeDebugPrivilege 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeDebugPrivilege 1164 taskkill.exe Token: 33 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: 33 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe Token: SeIncBasePriorityPrivilege 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
013a54d88cabf8dd0afb664b6f1b06b7.exedescription pid process target process PID 1396 wrote to memory of 1724 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe netsh.exe PID 1396 wrote to memory of 1724 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe netsh.exe PID 1396 wrote to memory of 1724 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe netsh.exe PID 1396 wrote to memory of 1724 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe netsh.exe PID 1396 wrote to memory of 1164 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe taskkill.exe PID 1396 wrote to memory of 1164 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe taskkill.exe PID 1396 wrote to memory of 1164 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe taskkill.exe PID 1396 wrote to memory of 1164 1396 013a54d88cabf8dd0afb664b6f1b06b7.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\013a54d88cabf8dd0afb664b6f1b06b7.exe"C:\Users\Admin\AppData\Local\Temp\013a54d88cabf8dd0afb664b6f1b06b7.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\013a54d88cabf8dd0afb664b6f1b06b7.exe" "013a54d88cabf8dd0afb664b6f1b06b7.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe2⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1164-57-0x0000000000000000-mapping.dmp
-
memory/1396-54-0x00000000760E1000-0x00000000760E3000-memory.dmpFilesize
8KB
-
memory/1396-55-0x0000000074720000-0x0000000074CCB000-memory.dmpFilesize
5.7MB
-
memory/1396-59-0x0000000074720000-0x0000000074CCB000-memory.dmpFilesize
5.7MB
-
memory/1724-56-0x0000000000000000-mapping.dmp