Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30-10-2022 13:20
Static task
static1
Behavioral task
behavioral1
Sample
2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe
Resource
win7-20220812-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe
-
Size
528KB
-
MD5
93f551b18c9722e5739e98701e8f6d12
-
SHA1
365702038b528be0497c9b12ce2fdbdb59d245b2
-
SHA256
2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e
-
SHA512
65c8a68042caf06e43f775799c25493bbefa789b2de3c68baac911c74afcfc037c31e0b7b58b448d6dc5baf2e9d5435cb773b57ba41fc76ff3be93dbc8544c25
-
SSDEEP
12288:O1T9O/qYv8/iWlq0bZBZsI+oG1KsFXyeIeoUk:Ak0bNs9FtyeI+k
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\beard.exe = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{EBDD63AA-FDCB-BCF4-5BEE-DFF4C9A39E24} 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows = "C:\\Users\\Admin\\AppData\\Roaming\\beard.exe" 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1936 set thread context of 504 1936 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 79 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 908 reg.exe 4656 reg.exe 4612 reg.exe 4328 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeCreateTokenPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeAssignPrimaryTokenPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeLockMemoryPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeIncreaseQuotaPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeMachineAccountPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeTcbPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeSecurityPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeTakeOwnershipPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeLoadDriverPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeSystemProfilePrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeSystemtimePrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeProfSingleProcessPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeIncBasePriorityPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeCreatePagefilePrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeCreatePermanentPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeBackupPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeRestorePrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeShutdownPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeDebugPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeAuditPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeSystemEnvironmentPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeChangeNotifyPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeRemoteShutdownPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeUndockPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeSyncAgentPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeEnableDelegationPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeManageVolumePrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeImpersonatePrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: SeCreateGlobalPrivilege 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: 31 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: 32 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: 33 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: 34 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe Token: 35 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 1936 wrote to memory of 504 1936 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 79 PID 1936 wrote to memory of 504 1936 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 79 PID 1936 wrote to memory of 504 1936 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 79 PID 1936 wrote to memory of 504 1936 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 79 PID 1936 wrote to memory of 504 1936 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 79 PID 1936 wrote to memory of 504 1936 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 79 PID 1936 wrote to memory of 504 1936 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 79 PID 1936 wrote to memory of 504 1936 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 79 PID 504 wrote to memory of 1608 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 80 PID 504 wrote to memory of 1608 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 80 PID 504 wrote to memory of 1608 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 80 PID 504 wrote to memory of 1504 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 81 PID 504 wrote to memory of 1504 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 81 PID 504 wrote to memory of 1504 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 81 PID 504 wrote to memory of 2308 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 83 PID 504 wrote to memory of 2308 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 83 PID 504 wrote to memory of 2308 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 83 PID 504 wrote to memory of 3900 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 84 PID 504 wrote to memory of 3900 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 84 PID 504 wrote to memory of 3900 504 2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe 84 PID 1608 wrote to memory of 908 1608 cmd.exe 89 PID 1504 wrote to memory of 4328 1504 cmd.exe 88 PID 1608 wrote to memory of 908 1608 cmd.exe 89 PID 1608 wrote to memory of 908 1608 cmd.exe 89 PID 1504 wrote to memory of 4328 1504 cmd.exe 88 PID 1504 wrote to memory of 4328 1504 cmd.exe 88 PID 2308 wrote to memory of 4656 2308 cmd.exe 90 PID 2308 wrote to memory of 4656 2308 cmd.exe 90 PID 2308 wrote to memory of 4656 2308 cmd.exe 90 PID 3900 wrote to memory of 4612 3900 cmd.exe 91 PID 3900 wrote to memory of 4612 3900 cmd.exe 91 PID 3900 wrote to memory of 4612 3900 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe"C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe"C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe"2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:504 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1608 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:908
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1504 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\2c04b75e1fcfb842f20574e9f9b8b80d0fcae70bb372325e348cf1df4a3ff26e.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4328
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2308 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4656
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:3900 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\beard.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\beard.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4612
-
-
-