Analysis
-
max time kernel
149s -
max time network
146s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
21/10/2022, 02:16
Static task
static1
Behavioral task
behavioral1
Sample
c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe
Resource
win7-20220812-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe
-
Size
332KB
-
MD5
5482037ed4aa90a79efafd52f1a43fff
-
SHA1
f41242a8494a0f678b826096fafa1c4c431b69b8
-
SHA256
c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9
-
SHA512
77a3cbe7b18594dc59adaf9f2dbd439440d2deaf0cf553334690168f3213174cea0042710581224ec7414300366242e45e67f52bc167dd77c1bb3571da4191e1
-
SSDEEP
3072:Gaxvos7J0wbx24Pu++slAhKAFRn1gs4vJi+DhVrfQLDMVKuVbewXRP5/tz:GahlKL+Ah3FV1bcJzDHfeDnuVbewl5/1
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\lsass.exe = "C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe" c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCCF9FFA-BBDB-BAAF-D84B-CCFCEEBDE1CA} c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{BCCF9FFA-BBDB-BAAF-D84B-CCFCEEBDE1CA}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe" c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{BCCF9FFA-BBDB-BAAF-D84B-CCFCEEBDE1CA} c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{BCCF9FFA-BBDB-BAAF-D84B-CCFCEEBDE1CA}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe" c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe" c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\lsass.exe" c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 3900 reg.exe 4904 reg.exe 5016 reg.exe 3272 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeCreateTokenPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeAssignPrimaryTokenPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeLockMemoryPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeIncreaseQuotaPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeMachineAccountPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeTcbPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeSecurityPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeTakeOwnershipPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeLoadDriverPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeSystemProfilePrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeSystemtimePrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeProfSingleProcessPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeIncBasePriorityPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeCreatePagefilePrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeCreatePermanentPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeBackupPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeRestorePrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeShutdownPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeDebugPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeAuditPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeSystemEnvironmentPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeChangeNotifyPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeRemoteShutdownPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeUndockPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeSyncAgentPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeEnableDelegationPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeManageVolumePrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeImpersonatePrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeCreateGlobalPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: 31 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: 32 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: 33 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: 34 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: 35 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe Token: SeDebugPrivilege 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1192 wrote to memory of 4736 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 82 PID 1192 wrote to memory of 4736 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 82 PID 1192 wrote to memory of 4736 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 82 PID 1192 wrote to memory of 1044 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 83 PID 1192 wrote to memory of 1044 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 83 PID 1192 wrote to memory of 1044 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 83 PID 1192 wrote to memory of 1704 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 87 PID 1192 wrote to memory of 1704 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 87 PID 1192 wrote to memory of 1704 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 87 PID 1192 wrote to memory of 2216 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 85 PID 1192 wrote to memory of 2216 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 85 PID 1192 wrote to memory of 2216 1192 c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe 85 PID 1044 wrote to memory of 4904 1044 cmd.exe 90 PID 1044 wrote to memory of 4904 1044 cmd.exe 90 PID 1044 wrote to memory of 4904 1044 cmd.exe 90 PID 4736 wrote to memory of 3272 4736 cmd.exe 92 PID 4736 wrote to memory of 3272 4736 cmd.exe 92 PID 4736 wrote to memory of 3272 4736 cmd.exe 92 PID 2216 wrote to memory of 5016 2216 cmd.exe 91 PID 2216 wrote to memory of 5016 2216 cmd.exe 91 PID 2216 wrote to memory of 5016 2216 cmd.exe 91 PID 1704 wrote to memory of 3900 1704 cmd.exe 93 PID 1704 wrote to memory of 3900 1704 cmd.exe 93 PID 1704 wrote to memory of 3900 1704 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe"C:\Users\Admin\AppData\Local\Temp\c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1192 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4736 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3272
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1044 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\c38440c7a816994e2b975db8df23c1db1e2ef3085356256fa8bea22ae7e640b9.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:4904
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lsass.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lsass.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2216 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\lsass.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\lsass.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:5016
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1704 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3900
-
-