Analysis
-
max time kernel
189s -
max time network
46s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
11/10/2022, 08:11
Static task
static1
Behavioral task
behavioral1
Sample
25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe
-
Size
528KB
-
MD5
75cded002eb441aef67af3e5cc97c49d
-
SHA1
8588a13aaa8ae50609e419dea32f363ad8f6d704
-
SHA256
25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0
-
SHA512
d6c63e4b72975cf787b637f26bbac5dd6276abf1bb0a240020b78d70f7921371ab5730a88c47ade38ff5b3c026075c435a02d99eeea58c2d1708d100f6aa86f7
-
SSDEEP
12288:O1T9O/qYv8/iWlq0bZBZsI+oG1KsFXyeIeoU1:Ak0bNs9FtyeI+1
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\beard.exe = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1488 set thread context of 980 1488 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 27 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1728 reg.exe 1752 reg.exe 1188 reg.exe 392 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeCreateTokenPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeAssignPrimaryTokenPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeLockMemoryPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeIncreaseQuotaPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeMachineAccountPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeTcbPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeSecurityPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeTakeOwnershipPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeLoadDriverPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeSystemProfilePrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeSystemtimePrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeProfSingleProcessPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeIncBasePriorityPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeCreatePagefilePrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeCreatePermanentPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeBackupPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeRestorePrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeShutdownPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeDebugPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeAuditPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeSystemEnvironmentPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeChangeNotifyPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeRemoteShutdownPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeUndockPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeSyncAgentPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeEnableDelegationPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeManageVolumePrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeImpersonatePrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: SeCreateGlobalPrivilege 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: 31 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: 32 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: 33 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: 34 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe Token: 35 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1488 wrote to memory of 980 1488 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 27 PID 1488 wrote to memory of 980 1488 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 27 PID 1488 wrote to memory of 980 1488 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 27 PID 1488 wrote to memory of 980 1488 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 27 PID 1488 wrote to memory of 980 1488 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 27 PID 1488 wrote to memory of 980 1488 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 27 PID 1488 wrote to memory of 980 1488 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 27 PID 1488 wrote to memory of 980 1488 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 27 PID 980 wrote to memory of 1376 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 28 PID 980 wrote to memory of 1376 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 28 PID 980 wrote to memory of 1376 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 28 PID 980 wrote to memory of 1376 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 28 PID 980 wrote to memory of 1340 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 30 PID 980 wrote to memory of 1340 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 30 PID 980 wrote to memory of 1340 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 30 PID 980 wrote to memory of 1340 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 30 PID 980 wrote to memory of 1088 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 32 PID 980 wrote to memory of 1088 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 32 PID 980 wrote to memory of 1088 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 32 PID 980 wrote to memory of 1088 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 32 PID 980 wrote to memory of 1688 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 35 PID 980 wrote to memory of 1688 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 35 PID 980 wrote to memory of 1688 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 35 PID 980 wrote to memory of 1688 980 25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe 35 PID 1688 wrote to memory of 1188 1688 cmd.exe 38 PID 1688 wrote to memory of 1188 1688 cmd.exe 38 PID 1688 wrote to memory of 1188 1688 cmd.exe 38 PID 1688 wrote to memory of 1188 1688 cmd.exe 38 PID 1088 wrote to memory of 1752 1088 cmd.exe 37 PID 1088 wrote to memory of 1752 1088 cmd.exe 37 PID 1088 wrote to memory of 1752 1088 cmd.exe 37 PID 1088 wrote to memory of 1752 1088 cmd.exe 37 PID 1376 wrote to memory of 1728 1376 cmd.exe 36 PID 1376 wrote to memory of 1728 1376 cmd.exe 36 PID 1376 wrote to memory of 1728 1376 cmd.exe 36 PID 1376 wrote to memory of 1728 1376 cmd.exe 36 PID 1340 wrote to memory of 392 1340 cmd.exe 39 PID 1340 wrote to memory of 392 1340 cmd.exe 39 PID 1340 wrote to memory of 392 1340 cmd.exe 39 PID 1340 wrote to memory of 392 1340 cmd.exe 39
Processes
-
C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe"C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1488 -
C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe"C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:980 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1376 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1728
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\25fd73ffd2ab68531b7de50a141eb442ace3fbbccdf4eef695021048dd2205e0.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:392
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1088 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1752
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1688 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1188
-
-
-