Analysis
-
max time kernel
150s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 06:29
Static task
static1
Behavioral task
behavioral1
Sample
e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe
-
Size
528KB
-
MD5
2c01bfaae19e3ca6e91382b9a0271c75
-
SHA1
640d1535c6816cfc098964cecd1ab36567b3fe0a
-
SHA256
e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349
-
SHA512
b2d7a533f2ad0372bcc3c1443377721110bff8e23a6d2266d693a9fc4c1e41b805fdafeb32701f1eb261564a750e2ebe15b47a745e394178222a1311f4eeb853
-
SSDEEP
12288:O1T9O/qYv8/iWlq0bZBZsI+oG1KsFXyeIeoU7:Ak0bNs9FtyeI+7
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\beard.exe = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1672 set thread context of 1720 1672 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 27 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 108 reg.exe 856 reg.exe 1360 reg.exe 1876 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeCreateTokenPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeAssignPrimaryTokenPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeLockMemoryPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeIncreaseQuotaPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeMachineAccountPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeTcbPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeSecurityPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeTakeOwnershipPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeLoadDriverPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeSystemProfilePrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeSystemtimePrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeProfSingleProcessPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeIncBasePriorityPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeCreatePagefilePrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeCreatePermanentPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeBackupPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeRestorePrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeShutdownPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeDebugPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeAuditPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeSystemEnvironmentPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeChangeNotifyPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeRemoteShutdownPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeUndockPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeSyncAgentPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeEnableDelegationPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeManageVolumePrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeImpersonatePrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: SeCreateGlobalPrivilege 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: 31 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: 32 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: 33 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: 34 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe Token: 35 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1672 wrote to memory of 1720 1672 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 27 PID 1672 wrote to memory of 1720 1672 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 27 PID 1672 wrote to memory of 1720 1672 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 27 PID 1672 wrote to memory of 1720 1672 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 27 PID 1672 wrote to memory of 1720 1672 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 27 PID 1672 wrote to memory of 1720 1672 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 27 PID 1672 wrote to memory of 1720 1672 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 27 PID 1672 wrote to memory of 1720 1672 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 27 PID 1720 wrote to memory of 768 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 28 PID 1720 wrote to memory of 768 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 28 PID 1720 wrote to memory of 768 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 28 PID 1720 wrote to memory of 768 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 28 PID 1720 wrote to memory of 628 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 31 PID 1720 wrote to memory of 628 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 31 PID 1720 wrote to memory of 628 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 31 PID 1720 wrote to memory of 628 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 31 PID 1720 wrote to memory of 1620 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 29 PID 1720 wrote to memory of 1620 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 29 PID 1720 wrote to memory of 1620 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 29 PID 1720 wrote to memory of 1620 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 29 PID 768 wrote to memory of 108 768 cmd.exe 34 PID 768 wrote to memory of 108 768 cmd.exe 34 PID 768 wrote to memory of 108 768 cmd.exe 34 PID 768 wrote to memory of 108 768 cmd.exe 34 PID 628 wrote to memory of 856 628 cmd.exe 35 PID 628 wrote to memory of 856 628 cmd.exe 35 PID 628 wrote to memory of 856 628 cmd.exe 35 PID 628 wrote to memory of 856 628 cmd.exe 35 PID 1620 wrote to memory of 1360 1620 cmd.exe 36 PID 1620 wrote to memory of 1360 1620 cmd.exe 36 PID 1620 wrote to memory of 1360 1620 cmd.exe 36 PID 1620 wrote to memory of 1360 1620 cmd.exe 36 PID 1720 wrote to memory of 1816 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 38 PID 1720 wrote to memory of 1816 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 38 PID 1720 wrote to memory of 1816 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 38 PID 1720 wrote to memory of 1816 1720 e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe 38 PID 1816 wrote to memory of 1876 1816 cmd.exe 39 PID 1816 wrote to memory of 1876 1816 cmd.exe 39 PID 1816 wrote to memory of 1876 1816 cmd.exe 39 PID 1816 wrote to memory of 1876 1816 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe"C:\Users\Admin\AppData\Local\Temp\e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1672 -
C:\Users\Admin\AppData\Local\Temp\e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe"C:\Users\Admin\AppData\Local\Temp\e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1720 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:768 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:108
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1620 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1360
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:628 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\e36a2257035f6cf81bc898fcc51f71166f681fe584bddf5380fbcd1dca583349.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:856
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1816 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1876
-
-
-