Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
03/10/2022, 05:40
Static task
static1
Behavioral task
behavioral1
Sample
c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe
-
Size
132KB
-
MD5
6aea36d71ad1b2233ee7bcbc56da372c
-
SHA1
fea9859246847b749b7c1a94288c8e0555a5c07c
-
SHA256
c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30
-
SHA512
bf9bcea0a3ff69de1c6e63a4ba0f14e934fd9b71e1aeedec60f6c29d0dbe5c9ceb324cc0a4218bde97142120808493e2830fd0deed8e4bfd8d01bf188c45d317
-
SSDEEP
3072:dymaiGujNQyxJJfShIf0KKUOf8IKaLliSiEVsHA:Qm/j7B+cHOyaL1iA
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\svchost.exe = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe -
resource yara_rule behavioral1/memory/1388-54-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1388-57-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1388-58-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1388-63-0x0000000000400000-0x000000000045C000-memory.dmp upx behavioral1/memory/1388-72-0x0000000000400000-0x000000000045C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\svchost.exe" c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2028 set thread context of 1388 2028 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 27 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1532 reg.exe 1820 reg.exe 1256 reg.exe 1416 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeCreateTokenPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeAssignPrimaryTokenPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeLockMemoryPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeIncreaseQuotaPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeMachineAccountPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeTcbPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeSecurityPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeTakeOwnershipPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeLoadDriverPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeSystemProfilePrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeSystemtimePrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeProfSingleProcessPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeIncBasePriorityPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeCreatePagefilePrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeCreatePermanentPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeBackupPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeRestorePrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeShutdownPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeDebugPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeAuditPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeSystemEnvironmentPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeChangeNotifyPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeRemoteShutdownPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeUndockPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeSyncAgentPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeEnableDelegationPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeManageVolumePrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeImpersonatePrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeCreateGlobalPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: 31 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: 32 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: 33 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: 34 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: 35 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe Token: SeDebugPrivilege 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 2028 wrote to memory of 1388 2028 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 27 PID 2028 wrote to memory of 1388 2028 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 27 PID 2028 wrote to memory of 1388 2028 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 27 PID 2028 wrote to memory of 1388 2028 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 27 PID 2028 wrote to memory of 1388 2028 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 27 PID 2028 wrote to memory of 1388 2028 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 27 PID 2028 wrote to memory of 1388 2028 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 27 PID 2028 wrote to memory of 1388 2028 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 27 PID 1388 wrote to memory of 1372 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 28 PID 1388 wrote to memory of 1372 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 28 PID 1388 wrote to memory of 1372 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 28 PID 1388 wrote to memory of 1372 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 28 PID 1388 wrote to memory of 1380 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 29 PID 1388 wrote to memory of 1380 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 29 PID 1388 wrote to memory of 1380 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 29 PID 1388 wrote to memory of 1380 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 29 PID 1388 wrote to memory of 684 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 32 PID 1388 wrote to memory of 684 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 32 PID 1388 wrote to memory of 684 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 32 PID 1388 wrote to memory of 684 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 32 PID 1388 wrote to memory of 796 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 34 PID 1388 wrote to memory of 796 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 34 PID 1388 wrote to memory of 796 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 34 PID 1388 wrote to memory of 796 1388 c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe 34 PID 1372 wrote to memory of 1532 1372 cmd.exe 36 PID 1372 wrote to memory of 1532 1372 cmd.exe 36 PID 1372 wrote to memory of 1532 1372 cmd.exe 36 PID 1372 wrote to memory of 1532 1372 cmd.exe 36 PID 1380 wrote to memory of 1820 1380 cmd.exe 37 PID 1380 wrote to memory of 1820 1380 cmd.exe 37 PID 1380 wrote to memory of 1820 1380 cmd.exe 37 PID 1380 wrote to memory of 1820 1380 cmd.exe 37 PID 684 wrote to memory of 1256 684 cmd.exe 38 PID 684 wrote to memory of 1256 684 cmd.exe 38 PID 684 wrote to memory of 1256 684 cmd.exe 38 PID 684 wrote to memory of 1256 684 cmd.exe 38 PID 796 wrote to memory of 1416 796 cmd.exe 39 PID 796 wrote to memory of 1416 796 cmd.exe 39 PID 796 wrote to memory of 1416 796 cmd.exe 39 PID 796 wrote to memory of 1416 796 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe"C:\Users\Admin\AppData\Local\Temp\c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:2028 -
C:\Users\Admin\AppData\Local\Temp\c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exeC:\Users\Admin\AppData\Local\Temp\c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe2⤵
- Adds policy Run key to start application
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1388 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1372 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1532
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1380 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\c0d5dfe74e781d36d80d9292cb065c0a42beb3b4fb683dc1edefb34691b1ea30.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1820
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:684 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1256
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:796 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\svchost.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\svchost.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1416
-
-
-