Analysis
-
max time kernel
151s -
max time network
158s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
02-10-2022 11:54
Static task
static1
Behavioral task
behavioral1
Sample
ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe
Resource
win7-20220812-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
2 signatures
150 seconds
General
-
Target
ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe
-
Size
206KB
-
MD5
635a5aad75a562b40d9cd3e23f61bc77
-
SHA1
07718f751fc0fac84d01849f25ff38ea1403d1f9
-
SHA256
ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca
-
SHA512
73fb6e3672839a73c79ea3f962f224b3598d476165343bff594dafcf1e8cb2705ddfd2190a66970f38f317b26897cd25ac98f0def07993ec5e5319f8df40074b
-
SSDEEP
3072:JUdas6F7Oq4W+qWFG/zY//HlIwFlbThSAFP2jfhld03iuRXCpSvFWBMuQVxtt3ZP:xp0GZenU+2jfdkiuBvvF1l5Fg
Score
10/10
Malware Config
Signatures
-
Modifies system executable filetype association 2 TTPs 17 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\DefaultIcon\ = "%1" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\open twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\runas twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\start\command twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\ = "Application" twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\Content Type = "application/x-msdownload" twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\open\command twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\runas\command twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\DefaultIcon twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\start twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\twc.exe\" -a \"%1\" %*" twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" twc.exe -
Disables taskbar notifications via registry modification
-
Executes dropped EXE 2 IoCs
pid Process 1960 twc.exe 1764 twc.exe -
Modifies Installed Components in the registry 2 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components explorer.exe -
Deletes itself 1 IoCs
pid Process 1764 twc.exe -
Loads dropped DLL 2 IoCs
pid Process 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\ctfmon.exe = "C:\\WINDOWS\\system32\\ctfmon.exe" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run twc.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 364 set thread context of 1704 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 27 PID 1960 set thread context of 1764 1960 twc.exe 30 -
Modifies registry class 41 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\runas\command twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\runas\command\ = "\"%1\" %*" twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\Content Type = "application/x-msdownload" twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\runas\command\IsolatedCommand = "\"%1\" %*" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\open\command twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\start\command\IsolatedCommand = "\"%1\" %*" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\start twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\start\command twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\DefaultIcon\ = "%1" twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\runas\command\IsolatedCommand = "\"%1\" %*" twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\DefaultIcon\ = "%1" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\open twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\runas twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\NodeSlots explorer.exe Set value (data) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU\MRUListEx = ffffffff explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\ = "exefile" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\DefaultIcon twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\runas twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\start\command\IsolatedCommand = "\"%1\" %*" twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\Content Type = "application/x-msdownload" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\runas\command twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\start\command\ = "\"%1\" %*" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\open\command twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\twc.exe\" -a \"%1\" %*" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\DefaultIcon twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\Local Settings\Software\Microsoft\Windows\Shell\BagMRU explorer.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\open twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\open\command\ = "\"C:\\Users\\Admin\\AppData\\Local\\twc.exe\" -a \"%1\" %*" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\start\command twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\start\command\ = "\"%1\" %*" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_Classes\Local Settings explorer.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\open\command\IsolatedCommand = "\"%1\" %*" twc.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\.exe\shell\start twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\ = "Application" twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\open\command\IsolatedCommand = "\"%1\" %*" twc.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000_CLASSES\exefile\shell\runas\command\ = "\"%1\" %*" twc.exe -
Suspicious behavior: EnumeratesProcesses 14 IoCs
pid Process 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 1764 twc.exe 1764 twc.exe 1764 twc.exe 1764 twc.exe 1764 twc.exe -
Suspicious use of AdjustPrivilegeToken 21 IoCs
description pid Process Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: 33 1616 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1616 AUDIODG.EXE Token: 33 1616 AUDIODG.EXE Token: SeIncBasePriorityPrivilege 1616 AUDIODG.EXE Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe Token: SeShutdownPrivilege 2036 explorer.exe -
Suspicious use of FindShellTrayWindow 29 IoCs
pid Process 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 1764 twc.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 1764 twc.exe 2036 explorer.exe 2036 explorer.exe -
Suspicious use of SendNotifyMessage 17 IoCs
pid Process 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 2036 explorer.exe 1764 twc.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 364 wrote to memory of 1620 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 26 PID 364 wrote to memory of 1620 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 26 PID 364 wrote to memory of 1620 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 26 PID 364 wrote to memory of 1620 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 26 PID 364 wrote to memory of 1704 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 27 PID 364 wrote to memory of 1704 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 27 PID 364 wrote to memory of 1704 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 27 PID 364 wrote to memory of 1704 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 27 PID 364 wrote to memory of 1704 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 27 PID 364 wrote to memory of 1704 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 27 PID 364 wrote to memory of 1704 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 27 PID 364 wrote to memory of 1704 364 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 27 PID 1704 wrote to memory of 1960 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 28 PID 1704 wrote to memory of 1960 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 28 PID 1704 wrote to memory of 1960 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 28 PID 1704 wrote to memory of 1960 1704 ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe 28 PID 1960 wrote to memory of 1764 1960 twc.exe 30 PID 1960 wrote to memory of 1764 1960 twc.exe 30 PID 1960 wrote to memory of 1764 1960 twc.exe 30 PID 1960 wrote to memory of 1764 1960 twc.exe 30 PID 1960 wrote to memory of 1764 1960 twc.exe 30 PID 1960 wrote to memory of 1764 1960 twc.exe 30 PID 1960 wrote to memory of 1764 1960 twc.exe 30 PID 1960 wrote to memory of 1764 1960 twc.exe 30
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe"C:\Users\Admin\AppData\Local\Temp\ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:364 -
C:\Windows\splwow64.exeC:\Windows\splwow64.exe 122882⤵PID:1620
-
-
C:\Users\Admin\AppData\Local\Temp\ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe"C:\Users\Admin\AppData\Local\Temp\ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe"2⤵
- Loads dropped DLL
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Users\Admin\AppData\Local\twc.exe"C:\Users\Admin\AppData\Local\twc.exe" -gav C:\Users\Admin\AppData\Local\Temp\ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1960 -
C:\Users\Admin\AppData\Local\twc.exe"C:\Users\Admin\AppData\Local\twc.exe" -gav C:\Users\Admin\AppData\Local\Temp\ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca.exe4⤵
- Modifies system executable filetype association
- Executes dropped EXE
- Deletes itself
- Adds Run key to start application
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1764
-
-
-
-
C:\Windows\explorer.exeexplorer.exe1⤵
- Modifies Installed Components in the registry
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:2036
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x5941⤵
- Suspicious use of AdjustPrivilegeToken
PID:1616
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
206KB
MD5635a5aad75a562b40d9cd3e23f61bc77
SHA107718f751fc0fac84d01849f25ff38ea1403d1f9
SHA256ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca
SHA51273fb6e3672839a73c79ea3f962f224b3598d476165343bff594dafcf1e8cb2705ddfd2190a66970f38f317b26897cd25ac98f0def07993ec5e5319f8df40074b
-
Filesize
206KB
MD5635a5aad75a562b40d9cd3e23f61bc77
SHA107718f751fc0fac84d01849f25ff38ea1403d1f9
SHA256ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca
SHA51273fb6e3672839a73c79ea3f962f224b3598d476165343bff594dafcf1e8cb2705ddfd2190a66970f38f317b26897cd25ac98f0def07993ec5e5319f8df40074b
-
Filesize
206KB
MD5635a5aad75a562b40d9cd3e23f61bc77
SHA107718f751fc0fac84d01849f25ff38ea1403d1f9
SHA256ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca
SHA51273fb6e3672839a73c79ea3f962f224b3598d476165343bff594dafcf1e8cb2705ddfd2190a66970f38f317b26897cd25ac98f0def07993ec5e5319f8df40074b
-
Filesize
206KB
MD5635a5aad75a562b40d9cd3e23f61bc77
SHA107718f751fc0fac84d01849f25ff38ea1403d1f9
SHA256ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca
SHA51273fb6e3672839a73c79ea3f962f224b3598d476165343bff594dafcf1e8cb2705ddfd2190a66970f38f317b26897cd25ac98f0def07993ec5e5319f8df40074b
-
Filesize
206KB
MD5635a5aad75a562b40d9cd3e23f61bc77
SHA107718f751fc0fac84d01849f25ff38ea1403d1f9
SHA256ebd187987d3d0b922fba1741bd96312798ef1888816a325766747866ca8d15ca
SHA51273fb6e3672839a73c79ea3f962f224b3598d476165343bff594dafcf1e8cb2705ddfd2190a66970f38f317b26897cd25ac98f0def07993ec5e5319f8df40074b