Analysis
-
max time kernel
149s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
30/10/2022, 13:20
Static task
static1
Behavioral task
behavioral1
Sample
2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe
-
Size
528KB
-
MD5
93f551b18c9722e5739e98701e8f6d12
-
SHA1
365702038b528be0497c9b12ce2fdbdb59d245b2
-
SHA256
2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e
-
SHA512
65c8a68042caf06e43f775799c25493bbefa789b2de3c68baac911c74afcfc037c31e0b7b58b448d6dc5baf2e9d5435cb773b57ba41fc76ff3be93dbc8544c25
-
SSDEEP
12288:O1T9O/qYv8/iWlq0bZBZsI+oG1KsFXyeIeoUk:Ak0bNs9FtyeI+k
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\beard.exe = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe:*:Enabled:Windows Messanger" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Key created \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Set value (str) \REGISTRY\USER\S-1-5-21-999675638-2867687379-27515722-1000\Software\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1584 set thread context of 1772 1584 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 26 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1960 reg.exe 520 reg.exe 636 reg.exe 1816 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeCreateTokenPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeAssignPrimaryTokenPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeLockMemoryPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeIncreaseQuotaPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeMachineAccountPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeTcbPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeSecurityPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeTakeOwnershipPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeLoadDriverPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeSystemProfilePrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeSystemtimePrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeProfSingleProcessPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeIncBasePriorityPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeCreatePagefilePrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeCreatePermanentPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeBackupPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeRestorePrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeShutdownPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeDebugPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeAuditPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeSystemEnvironmentPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeChangeNotifyPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeRemoteShutdownPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeUndockPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeSyncAgentPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeEnableDelegationPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeManageVolumePrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeImpersonatePrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeCreateGlobalPrivilege 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: 31 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: 32 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: 33 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: 34 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: 35 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1584 wrote to memory of 1772 1584 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 26 PID 1584 wrote to memory of 1772 1584 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 26 PID 1584 wrote to memory of 1772 1584 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 26 PID 1584 wrote to memory of 1772 1584 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 26 PID 1584 wrote to memory of 1772 1584 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 26 PID 1584 wrote to memory of 1772 1584 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 26 PID 1584 wrote to memory of 1772 1584 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 26 PID 1584 wrote to memory of 1772 1584 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 26 PID 1772 wrote to memory of 904 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 27 PID 1772 wrote to memory of 904 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 27 PID 1772 wrote to memory of 904 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 27 PID 1772 wrote to memory of 904 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 27 PID 1772 wrote to memory of 948 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 29 PID 1772 wrote to memory of 948 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 29 PID 1772 wrote to memory of 948 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 29 PID 1772 wrote to memory of 948 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 29 PID 1772 wrote to memory of 1108 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 31 PID 1772 wrote to memory of 1108 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 31 PID 1772 wrote to memory of 1108 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 31 PID 1772 wrote to memory of 1108 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 31 PID 1772 wrote to memory of 1068 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 33 PID 1772 wrote to memory of 1068 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 33 PID 1772 wrote to memory of 1068 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 33 PID 1772 wrote to memory of 1068 1772 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 33 PID 904 wrote to memory of 520 904 cmd.exe 36 PID 904 wrote to memory of 520 904 cmd.exe 36 PID 904 wrote to memory of 520 904 cmd.exe 36 PID 904 wrote to memory of 520 904 cmd.exe 36 PID 1068 wrote to memory of 1960 1068 cmd.exe 35 PID 1068 wrote to memory of 1960 1068 cmd.exe 35 PID 1068 wrote to memory of 1960 1068 cmd.exe 35 PID 1068 wrote to memory of 1960 1068 cmd.exe 35 PID 948 wrote to memory of 636 948 cmd.exe 37 PID 948 wrote to memory of 636 948 cmd.exe 37 PID 948 wrote to memory of 636 948 cmd.exe 37 PID 948 wrote to memory of 636 948 cmd.exe 37 PID 1108 wrote to memory of 1816 1108 cmd.exe 38 PID 1108 wrote to memory of 1816 1108 cmd.exe 38 PID 1108 wrote to memory of 1816 1108 cmd.exe 38 PID 1108 wrote to memory of 1816 1108 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe"C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1584 -
C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe"C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:904 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:520
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:948 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:636
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1108 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1816
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1068 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1960
-
-
-