Analysis
-
max time kernel
93s -
max time network
101s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
03/10/2022, 13:21
Static task
static1
Behavioral task
behavioral1
Sample
db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe
Resource
win10v2004-20220812-en
Errors
General
-
Target
db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe
-
Size
43KB
-
MD5
6913fd0b7cf42c6bc466d52575d1d1f0
-
SHA1
637b805c072ba3a974e77fc8cf19ec1ad88298ca
-
SHA256
db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193
-
SHA512
d28c3ed694aaa5c07577fe78219a42cdfd4110591c7845c2aa003cecc2d556015a26f6e7052c30d99a125e4ade64437ab52783ff5eb8819a3111e700db2d8e5e
-
SSDEEP
768:u5DZ2Sai733ZL4OsPDsJOrvNQ3wzbYYiUCb6BJZObQC73m9BaNV9kAVy+6f/heT2:ji18OysUQpYiUCb9Z3dggy+9
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List WmInit.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile WmInit.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications WmInit.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List WmInit.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\WmInit.exe = "C:\\Windows\\SysWOW64\\WmInit.exe:*:Enabled:Microsoft Windows Media" WmInit.exe -
Executes dropped EXE 1 IoCs
pid Process 2068 WmInit.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\Software\WOW6432Node\Microsoft\Windows\CurrentVersion\Run WmInit.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Media = "C:\\Windows\\SysWOW64\\WmInit.exe" WmInit.exe -
Drops file in System32 directory 10 IoCs
description ioc Process File created C:\Windows\SysWOW64\tmp WmInit.exe File opened for modification \??\c:\windows\SysWOW64\spoolsv.exe WmInit.exe File opened for modification C:\Windows\SysWOW64\tmp db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe File created C:\Windows\SysWOW64\tmp db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe File created C:\Windows\SysWOW64\WmInit.dat db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe File opened for modification C:\Windows\SysWOW64\WmInit.exe db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe File created C:\Windows\SysWOW64\WmInit.exe db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe File opened for modification C:\Windows\SysWOW64\tmp WmInit.exe File opened for modification \??\c:\windows\SysWOW64\lsass.exe WmInit.exe File opened for modification \??\c:\windows\SysWOW64\dllhost.exe WmInit.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2068 WmInit.exe 2068 WmInit.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2068 WmInit.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 4300 wrote to memory of 2068 4300 db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe 83 PID 4300 wrote to memory of 2068 4300 db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe 83 PID 4300 wrote to memory of 2068 4300 db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe"C:\Users\Admin\AppData\Local\Temp\db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe"1⤵
- Drops file in System32 directory
- Suspicious use of WriteProcessMemory
PID:4300 -
C:\Windows\SysWOW64\WmInit.exe"C:\Windows\system32\WmInit.exe" "C:\Users\Admin\AppData\Local\Temp\db70fd132b9eb59e94c123589b64665cd0446586da7243d84b7271638be08193.exe"2⤵
- Modifies firewall policy service
- Executes dropped EXE
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:2068
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
8B
MD5f1047782af8e9a44a0016b1e74af52bf
SHA1b16822553317851f9faa21232ab7fef77444826d
SHA256b27c0860e731584cd7b8d273510580790573825d4b6ee170d4bc91bbc87df467
SHA51274c63bcd97e0e63da5861c1b866ff6165056f018e726cc9b0bdda7c5be493edae5d33706c8ea3d9ab057e5b352b76cad8d825b64293ec4751b269d245a517140
-
Filesize
33.4MB
MD50d9a34a0689fe1cc7f4d4dd3493855ad
SHA12e227168f9682643dbc9ff0f0170d3ff165b901f
SHA25672ffa0846c79bdc528fe070e0738ce5c42807696880aa0762775f9ed345a960a
SHA5122a2acaf4fe867026a4e6bfc8476169331e33bb046857112b8f4bc65bfbbe4a88ec207205d49867d4d226c176548e38243a9ba504c4f142717b3c611e258f2e65
-
Filesize
33.4MB
MD50d9a34a0689fe1cc7f4d4dd3493855ad
SHA12e227168f9682643dbc9ff0f0170d3ff165b901f
SHA25672ffa0846c79bdc528fe070e0738ce5c42807696880aa0762775f9ed345a960a
SHA5122a2acaf4fe867026a4e6bfc8476169331e33bb046857112b8f4bc65bfbbe4a88ec207205d49867d4d226c176548e38243a9ba504c4f142717b3c611e258f2e65