Analysis
-
max time kernel
151s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
19-09-2022 08:07
Behavioral task
behavioral1
Sample
43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe
Resource
win7-20220812-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
14 signatures
150 seconds
General
-
Target
43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe
-
Size
757KB
-
MD5
5b6c2380d485e135ae0a557c411d9be3
-
SHA1
1a95c16d0e67926dc90dbfe333989331a1782f47
-
SHA256
43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3
-
SHA512
921f35f39e085ee297de57fe764a893e174f21e57a90ff8480b41ed435fb53e8e91e8086005eaee792c35de24c9af7c82de5b499c9b3da3ce4d1d2a98125833a
-
SSDEEP
12288:v9AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnK7Qb:VAQ6Zx9cxTmOrucTIEFSpOGh
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" explorer.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe -
Disables RegEdit via registry modification 1 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" explorer.exe -
Disables Task Manager via registry modification
-
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" notepad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4960 set thread context of 4428 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 86 -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 4428 explorer.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeSecurityPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeTakeOwnershipPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeLoadDriverPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeSystemProfilePrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeSystemtimePrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeProfSingleProcessPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeIncBasePriorityPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeCreatePagefilePrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeBackupPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeRestorePrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeShutdownPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeDebugPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeSystemEnvironmentPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeChangeNotifyPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeRemoteShutdownPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeUndockPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeManageVolumePrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeImpersonatePrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeCreateGlobalPrivilege 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: 33 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: 34 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: 35 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: 36 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe Token: SeIncreaseQuotaPrivilege 4428 explorer.exe Token: SeSecurityPrivilege 4428 explorer.exe Token: SeTakeOwnershipPrivilege 4428 explorer.exe Token: SeLoadDriverPrivilege 4428 explorer.exe Token: SeSystemProfilePrivilege 4428 explorer.exe Token: SeSystemtimePrivilege 4428 explorer.exe Token: SeProfSingleProcessPrivilege 4428 explorer.exe Token: SeIncBasePriorityPrivilege 4428 explorer.exe Token: SeCreatePagefilePrivilege 4428 explorer.exe Token: SeBackupPrivilege 4428 explorer.exe Token: SeRestorePrivilege 4428 explorer.exe Token: SeShutdownPrivilege 4428 explorer.exe Token: SeDebugPrivilege 4428 explorer.exe Token: SeSystemEnvironmentPrivilege 4428 explorer.exe Token: SeChangeNotifyPrivilege 4428 explorer.exe Token: SeRemoteShutdownPrivilege 4428 explorer.exe Token: SeUndockPrivilege 4428 explorer.exe Token: SeManageVolumePrivilege 4428 explorer.exe Token: SeImpersonatePrivilege 4428 explorer.exe Token: SeCreateGlobalPrivilege 4428 explorer.exe Token: 33 4428 explorer.exe Token: 34 4428 explorer.exe Token: 35 4428 explorer.exe Token: 36 4428 explorer.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 3668 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 85 PID 4960 wrote to memory of 4428 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 86 PID 4960 wrote to memory of 4428 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 86 PID 4960 wrote to memory of 4428 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 86 PID 4960 wrote to memory of 4428 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 86 PID 4960 wrote to memory of 4428 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 86 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4960 wrote to memory of 4432 4960 43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe 87 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88 PID 4428 wrote to memory of 1380 4428 explorer.exe 88
Processes
-
C:\Users\Admin\AppData\Local\Temp\43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe"C:\Users\Admin\AppData\Local\Temp\43c1580313aa7402fa73a8765479800a6e5adc77e4fae6a573643d3b7163b1e3.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4960 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
PID:3668
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Modifies firewall policy service
- Windows security bypass
- Disables RegEdit via registry modification
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4428 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe3⤵PID:1380
-
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe2⤵PID:4432
-