Analysis
-
max time kernel
152s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 02:20
Behavioral task
behavioral1
Sample
0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe
Resource
win10v2004-20220901-en
General
-
Target
0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe
-
Size
691KB
-
MD5
4dfe8edec4def757572fe47433f62f17
-
SHA1
90c20928fb44120b61c74566ffa8da677a76467a
-
SHA256
0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab
-
SHA512
9078bb932543b7f639ce22f3681e0a7554bde23934a9a9053cc0446e59363c76aa68a0d9ae8aa0da2e3c35f9eeb596874d169520199ccd752f5defa210b7a19b
-
SSDEEP
12288:19AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnK2B:zAQ6Zx9cxTmOrucTIEFSpOG
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe" 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" explorer.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" explorer.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe" 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe" notepad.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\Windupdt\svchost.exe 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe File opened for modification C:\Windows\SysWOW64\Windupdt\svchost.exe 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe File created C:\Windows\SysWOW64\Windupdt\svchost.exe notepad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1072 set thread context of 1148 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 28 -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1148 explorer.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeSecurityPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeTakeOwnershipPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeLoadDriverPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeSystemProfilePrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeSystemtimePrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeProfSingleProcessPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeIncBasePriorityPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeCreatePagefilePrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeBackupPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeRestorePrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeShutdownPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeDebugPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeSystemEnvironmentPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeChangeNotifyPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeRemoteShutdownPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeUndockPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeManageVolumePrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeImpersonatePrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeCreateGlobalPrivilege 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: 33 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: 34 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: 35 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeIncreaseQuotaPrivilege 1148 explorer.exe Token: SeSecurityPrivilege 1148 explorer.exe Token: SeTakeOwnershipPrivilege 1148 explorer.exe Token: SeLoadDriverPrivilege 1148 explorer.exe Token: SeSystemProfilePrivilege 1148 explorer.exe Token: SeSystemtimePrivilege 1148 explorer.exe Token: SeProfSingleProcessPrivilege 1148 explorer.exe Token: SeIncBasePriorityPrivilege 1148 explorer.exe Token: SeCreatePagefilePrivilege 1148 explorer.exe Token: SeBackupPrivilege 1148 explorer.exe Token: SeRestorePrivilege 1148 explorer.exe Token: SeShutdownPrivilege 1148 explorer.exe Token: SeDebugPrivilege 1148 explorer.exe Token: SeSystemEnvironmentPrivilege 1148 explorer.exe Token: SeChangeNotifyPrivilege 1148 explorer.exe Token: SeRemoteShutdownPrivilege 1148 explorer.exe Token: SeUndockPrivilege 1148 explorer.exe Token: SeManageVolumePrivilege 1148 explorer.exe Token: SeImpersonatePrivilege 1148 explorer.exe Token: SeCreateGlobalPrivilege 1148 explorer.exe Token: 33 1148 explorer.exe Token: 34 1148 explorer.exe Token: 35 1148 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1148 explorer.exe -
Suspicious use of WriteProcessMemory 53 IoCs
description pid Process procid_target PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1144 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 27 PID 1072 wrote to memory of 1148 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 28 PID 1072 wrote to memory of 1148 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 28 PID 1072 wrote to memory of 1148 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 28 PID 1072 wrote to memory of 1148 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 28 PID 1072 wrote to memory of 1148 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 28 PID 1072 wrote to memory of 1148 1072 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 28 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29 PID 1148 wrote to memory of 1376 1148 explorer.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe"C:\Users\Admin\AppData\Local\Temp\0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1072 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:1144
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1148 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe3⤵PID:1376
-
-