Analysis
-
max time kernel
148s -
max time network
150s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
29/10/2022, 23:04
Static task
static1
Behavioral task
behavioral1
Sample
0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe
Resource
win7-20220901-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe
-
Size
215KB
-
MD5
83adb2d3d03ad9b556b660f1894b03a7
-
SHA1
5677924f66569bff63039a91334c426a371190c0
-
SHA256
0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f
-
SHA512
4e34d4f1b437a3379a95b4e6467c8e1b8a359deab1906eecb29f78f70439ebcaa06e834a53030cd93680f1d6386dca01812be169f510c735592ab5519145c0f5
-
SSDEEP
6144:IuO4c4H76mBrXzq8hVuuOA5UbF47x3nBg1ZH2P:IT4HvBTWuOMwMhnBgeP
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\wblogin.exe = "C:\\Users\\Admin\\AppData\\Roaming\\wblogin.exe:*:Enabled:Windows Messanger" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\STARTUP = "C:\\Users\\Admin\\AppData\\Roaming\\wblogin.exe" 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DDAA0AFB-AAD3-E1BA-DDBB-6BBFE54CBAFC} 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{DDAA0AFB-AAD3-E1BA-DDBB-6BBFE54CBAFC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\wblogin.exe" 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{DDAA0AFB-AAD3-E1BA-DDBB-6BBFE54CBAFC} 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components\{DDAA0AFB-AAD3-E1BA-DDBB-6BBFE54CBAFC}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\wblogin.exe" 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe -
resource yara_rule behavioral1/memory/620-56-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral1/memory/620-58-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral1/memory/620-59-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral1/memory/620-63-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral1/memory/620-64-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral1/memory/620-77-0x0000000000400000-0x0000000000474000-memory.dmp upx behavioral1/memory/620-78-0x0000000000400000-0x0000000000474000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\STARTUP = "C:\\Users\\Admin\\AppData\\Roaming\\wblogin.exe" 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Windows\CurrentVersion\Run\STARTUP = "C:\\Users\\Admin\\AppData\\Roaming\\wblogin.exe" 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1480 set thread context of 620 1480 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 27 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 980 reg.exe 924 reg.exe 1624 reg.exe 1048 reg.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1480 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeCreateTokenPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeAssignPrimaryTokenPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeLockMemoryPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeIncreaseQuotaPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeMachineAccountPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeTcbPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeSecurityPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeTakeOwnershipPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeLoadDriverPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeSystemProfilePrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeSystemtimePrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeProfSingleProcessPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeIncBasePriorityPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeCreatePagefilePrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeCreatePermanentPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeBackupPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeRestorePrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeShutdownPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeDebugPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeAuditPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeSystemEnvironmentPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeChangeNotifyPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeRemoteShutdownPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeUndockPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeSyncAgentPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeEnableDelegationPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeManageVolumePrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeImpersonatePrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: SeCreateGlobalPrivilege 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: 31 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: 32 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: 33 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: 34 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe Token: 35 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 1480 wrote to memory of 620 1480 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 27 PID 1480 wrote to memory of 620 1480 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 27 PID 1480 wrote to memory of 620 1480 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 27 PID 1480 wrote to memory of 620 1480 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 27 PID 1480 wrote to memory of 620 1480 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 27 PID 1480 wrote to memory of 620 1480 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 27 PID 1480 wrote to memory of 620 1480 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 27 PID 620 wrote to memory of 1412 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 28 PID 620 wrote to memory of 1412 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 28 PID 620 wrote to memory of 1412 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 28 PID 620 wrote to memory of 1412 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 28 PID 620 wrote to memory of 1180 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 31 PID 620 wrote to memory of 1180 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 31 PID 620 wrote to memory of 1180 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 31 PID 620 wrote to memory of 1180 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 31 PID 620 wrote to memory of 572 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 29 PID 620 wrote to memory of 572 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 29 PID 620 wrote to memory of 572 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 29 PID 620 wrote to memory of 572 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 29 PID 620 wrote to memory of 584 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 35 PID 620 wrote to memory of 584 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 35 PID 620 wrote to memory of 584 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 35 PID 620 wrote to memory of 584 620 0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe 35 PID 1412 wrote to memory of 1048 1412 cmd.exe 39 PID 1412 wrote to memory of 1048 1412 cmd.exe 39 PID 1412 wrote to memory of 1048 1412 cmd.exe 39 PID 1412 wrote to memory of 1048 1412 cmd.exe 39 PID 1180 wrote to memory of 1624 1180 cmd.exe 38 PID 1180 wrote to memory of 1624 1180 cmd.exe 38 PID 1180 wrote to memory of 1624 1180 cmd.exe 38 PID 1180 wrote to memory of 1624 1180 cmd.exe 38 PID 584 wrote to memory of 924 584 cmd.exe 37 PID 584 wrote to memory of 924 584 cmd.exe 37 PID 584 wrote to memory of 924 584 cmd.exe 37 PID 584 wrote to memory of 924 584 cmd.exe 37 PID 572 wrote to memory of 980 572 cmd.exe 36 PID 572 wrote to memory of 980 572 cmd.exe 36 PID 572 wrote to memory of 980 572 cmd.exe 36 PID 572 wrote to memory of 980 572 cmd.exe 36
Processes
-
C:\Users\Admin\AppData\Local\Temp\0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe"C:\Users\Admin\AppData\Local\Temp\0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of WriteProcessMemory
PID:1480 -
C:\Users\Admin\AppData\Local\Temp\0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exeC:\Users\Admin\AppData\Local\Temp\0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:620 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1412 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1048
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:572 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:980
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1180 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\0ee19397a8b455d813b0fb37ece07623778c28ca43e23e6c6c36494f37fb4f0f.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1624
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\wblogin.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\wblogin.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\wblogin.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\wblogin.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:924
-
-
-