Analysis
-
max time kernel
150s -
max time network
60s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03-10-2022 13:36
Static task
static1
Behavioral task
behavioral1
Sample
c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe
-
Size
410KB
-
MD5
4e365bc14b31628a111db00fec7ed420
-
SHA1
76a26ff708be21f1f7a511a1ef3889633d5bf009
-
SHA256
c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024
-
SHA512
afd7089b93a5e93a416814f51e5e1f533b03b06f908207b2a57f405ee39c2a13459bed01d583092b5db07e493fc33b5bed8ceabfcf448dc08ad7b12a150f9857
-
SSDEEP
6144:SnMC4fNJ3mrR2ZW02borC1ym7ieiWZOHuoomHgBnU76Snvmpl5Eh:SZ4f2rR2FrC137ieiWZ0u+gDSnvmBEh
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Windows\SysWOW64\svchost.exe = "C:\\Windows\\SysWOW64\\svchost.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\explorer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\explorer.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
resource yara_rule behavioral1/memory/324-58-0x0000000000400000-0x000000000047C000-memory.dmp upx behavioral1/memory/324-60-0x0000000000400000-0x000000000047C000-memory.dmp upx behavioral1/memory/324-61-0x0000000000400000-0x000000000047C000-memory.dmp upx behavioral1/memory/324-64-0x0000000000400000-0x000000000047C000-memory.dmp upx behavioral1/memory/324-65-0x0000000000400000-0x000000000047C000-memory.dmp upx behavioral1/memory/324-79-0x0000000000400000-0x000000000047C000-memory.dmp upx -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\sidebar = "C:\\Users\\Admin\\AppData\\Roaming\\Sample.lnk" c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 748 set thread context of 324 748 c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe 27 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Modifies registry key 1 TTPs 4 IoCs
pid Process 1228 reg.exe 1988 reg.exe 920 reg.exe 280 reg.exe -
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 748 c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: SeDebugPrivilege 748 c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe Token: 1 324 svchost.exe Token: SeCreateTokenPrivilege 324 svchost.exe Token: SeAssignPrimaryTokenPrivilege 324 svchost.exe Token: SeLockMemoryPrivilege 324 svchost.exe Token: SeIncreaseQuotaPrivilege 324 svchost.exe Token: SeMachineAccountPrivilege 324 svchost.exe Token: SeTcbPrivilege 324 svchost.exe Token: SeSecurityPrivilege 324 svchost.exe Token: SeTakeOwnershipPrivilege 324 svchost.exe Token: SeLoadDriverPrivilege 324 svchost.exe Token: SeSystemProfilePrivilege 324 svchost.exe Token: SeSystemtimePrivilege 324 svchost.exe Token: SeProfSingleProcessPrivilege 324 svchost.exe Token: SeIncBasePriorityPrivilege 324 svchost.exe Token: SeCreatePagefilePrivilege 324 svchost.exe Token: SeCreatePermanentPrivilege 324 svchost.exe Token: SeBackupPrivilege 324 svchost.exe Token: SeRestorePrivilege 324 svchost.exe Token: SeShutdownPrivilege 324 svchost.exe Token: SeDebugPrivilege 324 svchost.exe Token: SeAuditPrivilege 324 svchost.exe Token: SeSystemEnvironmentPrivilege 324 svchost.exe Token: SeChangeNotifyPrivilege 324 svchost.exe Token: SeRemoteShutdownPrivilege 324 svchost.exe Token: SeUndockPrivilege 324 svchost.exe Token: SeSyncAgentPrivilege 324 svchost.exe Token: SeEnableDelegationPrivilege 324 svchost.exe Token: SeManageVolumePrivilege 324 svchost.exe Token: SeImpersonatePrivilege 324 svchost.exe Token: SeCreateGlobalPrivilege 324 svchost.exe Token: 31 324 svchost.exe Token: 32 324 svchost.exe Token: 33 324 svchost.exe Token: 34 324 svchost.exe Token: 35 324 svchost.exe -
Suspicious use of SetWindowsHookEx 7 IoCs
pid Process 324 svchost.exe 324 svchost.exe 324 svchost.exe 324 svchost.exe 324 svchost.exe 324 svchost.exe 324 svchost.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 748 wrote to memory of 324 748 c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe 27 PID 748 wrote to memory of 324 748 c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe 27 PID 748 wrote to memory of 324 748 c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe 27 PID 748 wrote to memory of 324 748 c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe 27 PID 748 wrote to memory of 324 748 c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe 27 PID 748 wrote to memory of 324 748 c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe 27 PID 748 wrote to memory of 324 748 c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe 27 PID 748 wrote to memory of 324 748 c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe 27 PID 324 wrote to memory of 1880 324 svchost.exe 28 PID 324 wrote to memory of 1880 324 svchost.exe 28 PID 324 wrote to memory of 1880 324 svchost.exe 28 PID 324 wrote to memory of 1880 324 svchost.exe 28 PID 324 wrote to memory of 884 324 svchost.exe 30 PID 324 wrote to memory of 884 324 svchost.exe 30 PID 324 wrote to memory of 884 324 svchost.exe 30 PID 324 wrote to memory of 884 324 svchost.exe 30 PID 324 wrote to memory of 472 324 svchost.exe 31 PID 324 wrote to memory of 472 324 svchost.exe 31 PID 324 wrote to memory of 472 324 svchost.exe 31 PID 324 wrote to memory of 472 324 svchost.exe 31 PID 324 wrote to memory of 1784 324 svchost.exe 34 PID 324 wrote to memory of 1784 324 svchost.exe 34 PID 324 wrote to memory of 1784 324 svchost.exe 34 PID 324 wrote to memory of 1784 324 svchost.exe 34 PID 1880 wrote to memory of 280 1880 cmd.exe 39 PID 1880 wrote to memory of 280 1880 cmd.exe 39 PID 1880 wrote to memory of 280 1880 cmd.exe 39 PID 1880 wrote to memory of 280 1880 cmd.exe 39 PID 884 wrote to memory of 920 884 cmd.exe 38 PID 884 wrote to memory of 920 884 cmd.exe 38 PID 884 wrote to memory of 920 884 cmd.exe 38 PID 884 wrote to memory of 920 884 cmd.exe 38 PID 1784 wrote to memory of 1228 1784 cmd.exe 36 PID 1784 wrote to memory of 1228 1784 cmd.exe 36 PID 1784 wrote to memory of 1228 1784 cmd.exe 36 PID 1784 wrote to memory of 1228 1784 cmd.exe 36 PID 472 wrote to memory of 1988 472 cmd.exe 37 PID 472 wrote to memory of 1988 472 cmd.exe 37 PID 472 wrote to memory of 1988 472 cmd.exe 37 PID 472 wrote to memory of 1988 472 cmd.exe 37
Processes
-
C:\Users\Admin\AppData\Local\Temp\c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe"C:\Users\Admin\AppData\Local\Temp\c4f84004703ead8f8ebedfe3d5afc8f0e213936582170bf18c46ab78b13fa024.exe"1⤵
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:748 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:324 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1880 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:280
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\SysWOW64\svchost.exe" /t REG_SZ /d "C:\Windows\SysWOW64\svchost.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:884 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Windows\SysWOW64\svchost.exe" /t REG_SZ /d "C:\Windows\SysWOW64\svchost.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:920
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:472 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1988
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explorer.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1784 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\explorer.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1228
-
-
-