Analysis
-
max time kernel
151s -
max time network
156s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
11/10/2022, 02:20
Behavioral task
behavioral1
Sample
0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe
Resource
win10v2004-20220901-en
General
-
Target
0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe
-
Size
691KB
-
MD5
4dfe8edec4def757572fe47433f62f17
-
SHA1
90c20928fb44120b61c74566ffa8da677a76467a
-
SHA256
0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab
-
SHA512
9078bb932543b7f639ce22f3681e0a7554bde23934a9a9053cc0446e59363c76aa68a0d9ae8aa0da2e3c35f9eeb596874d169520199ccd752f5defa210b7a19b
-
SSDEEP
12288:19AFlAd0Z+89cxTGzO4AucTD8QP2lmFSrVs9LqnK2B:zAQ6Zx9cxTmOrucTIEFSpOG
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windows\\system32\\Windupdt\\svchost.exe" 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe -
Modifies firewall policy service 2 TTPs 3 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" explorer.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" explorer.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile explorer.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" explorer.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" explorer.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" explorer.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate explorer.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe" 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windows\\system32\\Windupdt\\svchost.exe" notepad.exe -
Drops file in System32 directory 4 IoCs
description ioc Process File created C:\Windows\SysWOW64\Windupdt\svchost.exe 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe File opened for modification C:\Windows\SysWOW64\Windupdt\svchost.exe 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe File opened for modification C:\Windows\SysWOW64\Windupdt\ 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe File created C:\Windows\SysWOW64\Windupdt\svchost.exe notepad.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2708 set thread context of 3624 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 84 -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier explorer.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 explorer.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier explorer.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 3624 explorer.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeSecurityPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeTakeOwnershipPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeLoadDriverPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeSystemProfilePrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeSystemtimePrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeProfSingleProcessPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeIncBasePriorityPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeCreatePagefilePrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeBackupPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeRestorePrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeShutdownPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeDebugPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeSystemEnvironmentPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeChangeNotifyPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeRemoteShutdownPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeUndockPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeManageVolumePrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeImpersonatePrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeCreateGlobalPrivilege 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: 33 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: 34 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: 35 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: 36 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe Token: SeIncreaseQuotaPrivilege 3624 explorer.exe Token: SeSecurityPrivilege 3624 explorer.exe Token: SeTakeOwnershipPrivilege 3624 explorer.exe Token: SeLoadDriverPrivilege 3624 explorer.exe Token: SeSystemProfilePrivilege 3624 explorer.exe Token: SeSystemtimePrivilege 3624 explorer.exe Token: SeProfSingleProcessPrivilege 3624 explorer.exe Token: SeIncBasePriorityPrivilege 3624 explorer.exe Token: SeCreatePagefilePrivilege 3624 explorer.exe Token: SeBackupPrivilege 3624 explorer.exe Token: SeRestorePrivilege 3624 explorer.exe Token: SeShutdownPrivilege 3624 explorer.exe Token: SeDebugPrivilege 3624 explorer.exe Token: SeSystemEnvironmentPrivilege 3624 explorer.exe Token: SeChangeNotifyPrivilege 3624 explorer.exe Token: SeRemoteShutdownPrivilege 3624 explorer.exe Token: SeUndockPrivilege 3624 explorer.exe Token: SeManageVolumePrivilege 3624 explorer.exe Token: SeImpersonatePrivilege 3624 explorer.exe Token: SeCreateGlobalPrivilege 3624 explorer.exe Token: 33 3624 explorer.exe Token: 34 3624 explorer.exe Token: 35 3624 explorer.exe Token: 36 3624 explorer.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 3624 explorer.exe -
Suspicious use of WriteProcessMemory 50 IoCs
description pid Process procid_target PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 5020 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 83 PID 2708 wrote to memory of 3624 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 84 PID 2708 wrote to memory of 3624 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 84 PID 2708 wrote to memory of 3624 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 84 PID 2708 wrote to memory of 3624 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 84 PID 2708 wrote to memory of 3624 2708 0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe 84 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85 PID 3624 wrote to memory of 2292 3624 explorer.exe 85
Processes
-
C:\Users\Admin\AppData\Local\Temp\0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe"C:\Users\Admin\AppData\Local\Temp\0dbbf8345aaf2a9d57bd4ced5b456cb34f789ae813206a8eb18abeb5dadd6eab.exe"1⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious use of SetThreadContext
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2708 -
C:\Windows\SysWOW64\notepad.exenotepad2⤵
- Adds Run key to start application
- Drops file in System32 directory
PID:5020
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3624 -
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe3⤵PID:2292
-
-