Analysis
-
max time kernel
137s -
max time network
153s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
28-10-2022 18:06
Static task
static1
Behavioral task
behavioral1
Sample
43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe
-
Size
189KB
-
MD5
0c06f3adab5e71787a442444fc01dfa4
-
SHA1
d42133d5a3a20dcff8bef9b258e26cd27ff8e8f1
-
SHA256
43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903
-
SHA512
c167dd3210db76762907ae4d848f4c28b51db0b36f8b3652fa71b5d99837b78790542295036864699f4a37abc208cf6e65d60a3c13113f6f5676eb233acf8953
-
SSDEEP
3072:S8RhaJGIXTFWchPO9zGy6IY0pvPXK61d7q4ExsHOMLDylIwuor2hn2:/aFMchm9G2PXK6X9ExADEIa
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe -
Modifies security service 2 TTPs 26 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Uses the VBS compiler for execution 1 TTPs
-
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_32\Desktop.ini services.exe File created \systemroot\assembly\GAC_64\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1348 set thread context of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Installer\{f545a6cb-6387-4d75-375b-4ac5befd06b3}\@ vbc.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 672 vbc.exe 672 vbc.exe 672 vbc.exe 672 vbc.exe 672 vbc.exe 460 services.exe 672 vbc.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 672 vbc.exe Token: SeDebugPrivilege 672 vbc.exe Token: SeDebugPrivilege 672 vbc.exe Token: SeDebugPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1188 Explorer.EXE 1188 Explorer.EXE -
Suspicious use of WriteProcessMemory 22 IoCs
description pid Process procid_target PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 1348 wrote to memory of 672 1348 43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe 26 PID 672 wrote to memory of 1188 672 vbc.exe 17 PID 672 wrote to memory of 460 672 vbc.exe 2 PID 672 wrote to memory of 1820 672 vbc.exe 27 PID 672 wrote to memory of 1820 672 vbc.exe 27 PID 672 wrote to memory of 1820 672 vbc.exe 27 PID 672 wrote to memory of 1820 672 vbc.exe 27 PID 672 wrote to memory of 1820 672 vbc.exe 27 PID 672 wrote to memory of 1820 672 vbc.exe 27 PID 672 wrote to memory of 1820 672 vbc.exe 27
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1188 -
C:\Users\Admin\AppData\Local\Temp\43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe"C:\Users\Admin\AppData\Local\Temp\43c15d789aab951b882d293db5505233235f83d7099d8e7469729b51d3569903.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1348 -
C:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exeC:\Windows\Microsoft.NET\Framework\v2.0.50727\vbc.exe3⤵
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:672 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"4⤵PID:1820
-
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d6956dd78953b824ca410b5eb73440ad
SHA1ec5adfe55ad97f240abc8556a510929d34111cf1
SHA256beaf61d897f13ceb88897383e1b511b6baa0e567d6d8c8d3c8aff417b0c1a313
SHA512a457cc92f0aad8a315a9cee389b699112efb4d84ede819b97b5f0240a322cfbeccbac755cbac17bd563ada75818482025620e3c688fda999a05f746be6b5afdc