Analysis
-
max time kernel
138s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/10/2022, 11:41
Static task
static1
Behavioral task
behavioral1
Sample
ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe
Resource
win7-20220901-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe
-
Size
114KB
-
MD5
75aa766100cc00a023da88329c7792d9
-
SHA1
6b09bf4ad151316312e3ea1ca6496da85bf2db35
-
SHA256
ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097
-
SHA512
de570df22cc6356bc7e47dc14ff3f44046df6c68cc0f333227332bae63d875539d6af11021432c383de6e45470190bf0a96e22d9f48bdacdf6f789243a3f2957
-
SSDEEP
1536:nIe/0V+dTagDoFdcokBmzJEjr10OJl+kJLcNg38r0G3EtLKJZsn867QJlSEEwNVv:Ie/0VQagDojEBn1KktY3EFKkcJAxY
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe -
Modifies security service 2 TTPs 26 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security services.exe -
Deletes itself 1 IoCs
pid Process 1484 cmd.exe -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini services.exe File created \systemroot\assembly\GAC_32\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1752 set thread context of 1484 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 27 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Installer\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\@ ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 464 services.exe 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1236 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe Token: SeDebugPrivilege 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe Token: SeDebugPrivilege 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe Token: SeDebugPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1752 wrote to memory of 1236 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 19 PID 1752 wrote to memory of 464 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 2 PID 1752 wrote to memory of 1484 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 27 PID 1752 wrote to memory of 1484 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 27 PID 1752 wrote to memory of 1484 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 27 PID 1752 wrote to memory of 1484 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 27 PID 1752 wrote to memory of 1484 1752 ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe 27
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe"C:\Users\Admin\AppData\Local\Temp\ff7591112f2b8c1f6f283a5009432ef7ed68663d61689ede348edc407095f097.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1752 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:1484
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD577c062218f7ed56c77f9c254a1273974
SHA12b03e9e42018195329a0b1269ec827a8888808f9
SHA25618d2b9d25fcb50812fdb5f944083c74f4ccaaab2d40f6432e5a06182c628b901
SHA5128b5f25f29352bfed17a13f67105f144dcd485fb6e4c736d273446dda52f3d1bf6e75c026cc880ebfa7c4f0a4c2bd74c0e2212af24857ae4c0e3b4a2876f936cb