Analysis
-
max time kernel
151s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
20/10/2022, 01:08
Behavioral task
behavioral1
Sample
23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe
Resource
win10v2004-20220812-en
General
-
Target
23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe
-
Size
647KB
-
MD5
82d7fb6f8eac4e9de4b56956763f3e20
-
SHA1
bcae4eb9f4d54b10935a943a0d2edf404a1f062e
-
SHA256
23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca
-
SHA512
0c413294befd737df17712aa66e441b478cf4b96629ac267d3dd2c4ffce567abcc86f09992e3eeda13fb554af27a73e1063a6c67215341675efd2d45308583bd
-
SSDEEP
12288:Q8UaT9XY2siA0bMG09xD7I3Gg8ecgVvfBoCDBOQQYbVXpuy1f/gORixD:JUKoN0bUxgGa/pfBHDb+y1HgZZ
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 6 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" iexplore.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" iexplore.exe -
Modifies security service 2 TTPs 2 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" iexplore.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" iexplore.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe -
Sets file to hidden 1 TTPs 2 IoCs
Modifies file attributes to stop it showing in Explorer etc.
pid Process 2036 attrib.exe 2000 attrib.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\System.exe" 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Set value (str) \REGISTRY\USER\S-1-5-21-3845472200-3839195424-595303356-1000\Software\Microsoft\Windows\CurrentVersion\Run\System = "C:\\Users\\Admin\\AppData\\Roaming\\System32\\System.exe" iexplore.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1652 set thread context of 1060 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 31 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1060 iexplore.exe -
Suspicious use of AdjustPrivilegeToken 46 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeSecurityPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeTakeOwnershipPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeLoadDriverPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeSystemProfilePrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeSystemtimePrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeProfSingleProcessPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeIncBasePriorityPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeCreatePagefilePrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeBackupPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeRestorePrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeShutdownPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeDebugPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeSystemEnvironmentPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeChangeNotifyPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeRemoteShutdownPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeUndockPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeManageVolumePrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeImpersonatePrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeCreateGlobalPrivilege 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: 33 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: 34 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: 35 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Token: SeIncreaseQuotaPrivilege 1060 iexplore.exe Token: SeSecurityPrivilege 1060 iexplore.exe Token: SeTakeOwnershipPrivilege 1060 iexplore.exe Token: SeLoadDriverPrivilege 1060 iexplore.exe Token: SeSystemProfilePrivilege 1060 iexplore.exe Token: SeSystemtimePrivilege 1060 iexplore.exe Token: SeProfSingleProcessPrivilege 1060 iexplore.exe Token: SeIncBasePriorityPrivilege 1060 iexplore.exe Token: SeCreatePagefilePrivilege 1060 iexplore.exe Token: SeBackupPrivilege 1060 iexplore.exe Token: SeRestorePrivilege 1060 iexplore.exe Token: SeShutdownPrivilege 1060 iexplore.exe Token: SeDebugPrivilege 1060 iexplore.exe Token: SeSystemEnvironmentPrivilege 1060 iexplore.exe Token: SeChangeNotifyPrivilege 1060 iexplore.exe Token: SeRemoteShutdownPrivilege 1060 iexplore.exe Token: SeUndockPrivilege 1060 iexplore.exe Token: SeManageVolumePrivilege 1060 iexplore.exe Token: SeImpersonatePrivilege 1060 iexplore.exe Token: SeCreateGlobalPrivilege 1060 iexplore.exe Token: 33 1060 iexplore.exe Token: 34 1060 iexplore.exe Token: 35 1060 iexplore.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1060 iexplore.exe -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1652 wrote to memory of 1748 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 27 PID 1652 wrote to memory of 1748 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 27 PID 1652 wrote to memory of 1748 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 27 PID 1652 wrote to memory of 1748 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 27 PID 1652 wrote to memory of 608 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 29 PID 1652 wrote to memory of 608 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 29 PID 1652 wrote to memory of 608 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 29 PID 1652 wrote to memory of 608 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 29 PID 1652 wrote to memory of 1060 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 31 PID 1652 wrote to memory of 1060 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 31 PID 1652 wrote to memory of 1060 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 31 PID 1652 wrote to memory of 1060 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 31 PID 1652 wrote to memory of 1060 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 31 PID 1652 wrote to memory of 1060 1652 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe 31 PID 1748 wrote to memory of 2036 1748 cmd.exe 32 PID 1748 wrote to memory of 2036 1748 cmd.exe 32 PID 1748 wrote to memory of 2036 1748 cmd.exe 32 PID 1748 wrote to memory of 2036 1748 cmd.exe 32 PID 608 wrote to memory of 2000 608 cmd.exe 33 PID 608 wrote to memory of 2000 608 cmd.exe 33 PID 608 wrote to memory of 2000 608 cmd.exe 33 PID 608 wrote to memory of 2000 608 cmd.exe 33 -
System policy modification 1 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion\Explorern\NoControlPanel = "1" 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\CurrentVersion 23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe -
Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 2000 attrib.exe 2036 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe"C:\Users\Admin\AppData\Local\Temp\23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe"1⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Windows security modification
- Adds Run key to start application
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:1652 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp\23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:1748 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp\23c11251927fa2a1985305a1a1e9d9594023888ac962d55cc739b111ab8148ca.exe" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2036
-
-
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /k attrib "C:\Users\Admin\AppData\Local\Temp" +s +h2⤵
- Suspicious use of WriteProcessMemory
PID:608 -
C:\Windows\SysWOW64\attrib.exeattrib "C:\Users\Admin\AppData\Local\Temp" +s +h3⤵
- Sets file to hidden
- Views/modifies file attributes
PID:2000
-
-
-
C:\Program Files (x86)\Internet Explorer\iexplore.exe"C:\Program Files (x86)\Internet Explorer\iexplore.exe"2⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:1060
-