Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
30/10/2022, 20:55
Static task
static1
Behavioral task
behavioral1
Sample
8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe
Resource
win7-20220812-en
windows7-x64
6 signatures
150 seconds
Behavioral task
behavioral2
Sample
8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe
-
Size
336KB
-
MD5
90c967e9f95c7afbcad7d5556d689344
-
SHA1
d0faf34a99d1703598eaf3ac5ab1cbd48bbed10c
-
SHA256
8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152
-
SHA512
fee8cfa7ced8272a1ba9e9a11d7f312c9fb5592d8bbd73729e976f5eb5940ece049ab5e4f5868a3659dbe03ad7a94ce109c5ed48cbc04000e99e9020ebd147be
-
SSDEEP
6144:xG78LjzOANvSAsQLqF9pXMiY3sGB6UduRfLtcQ:47kmAN6omFMb3sGB6UduRfLaQ
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\Test2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Test2.exe:*:Enabled:Windows Messanger" reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1676 reg.exe 4792 reg.exe 4704 reg.exe 4776 reg.exe -
Suspicious behavior: RenamesItself 1 IoCs
pid Process 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeCreateTokenPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeAssignPrimaryTokenPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeLockMemoryPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeIncreaseQuotaPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeMachineAccountPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeTcbPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeSecurityPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeTakeOwnershipPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeLoadDriverPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeSystemProfilePrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeSystemtimePrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeProfSingleProcessPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeIncBasePriorityPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeCreatePagefilePrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeCreatePermanentPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeBackupPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeRestorePrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeShutdownPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeDebugPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeAuditPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeSystemEnvironmentPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeChangeNotifyPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeRemoteShutdownPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeUndockPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeSyncAgentPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeEnableDelegationPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeManageVolumePrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeImpersonatePrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: SeCreateGlobalPrivilege 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: 31 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: 32 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: 33 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: 34 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe Token: 35 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 2752 wrote to memory of 3708 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 82 PID 2752 wrote to memory of 3708 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 82 PID 2752 wrote to memory of 3708 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 82 PID 2752 wrote to memory of 1060 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 83 PID 2752 wrote to memory of 1060 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 83 PID 2752 wrote to memory of 1060 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 83 PID 2752 wrote to memory of 1928 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 84 PID 2752 wrote to memory of 1928 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 84 PID 2752 wrote to memory of 1928 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 84 PID 2752 wrote to memory of 3520 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 88 PID 2752 wrote to memory of 3520 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 88 PID 2752 wrote to memory of 3520 2752 8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe 88 PID 1060 wrote to memory of 1676 1060 cmd.exe 90 PID 1060 wrote to memory of 1676 1060 cmd.exe 90 PID 1060 wrote to memory of 1676 1060 cmd.exe 90 PID 1928 wrote to memory of 4792 1928 cmd.exe 91 PID 1928 wrote to memory of 4792 1928 cmd.exe 91 PID 1928 wrote to memory of 4792 1928 cmd.exe 91 PID 3520 wrote to memory of 4704 3520 cmd.exe 92 PID 3520 wrote to memory of 4704 3520 cmd.exe 92 PID 3520 wrote to memory of 4704 3520 cmd.exe 92 PID 3708 wrote to memory of 4776 3708 cmd.exe 93 PID 3708 wrote to memory of 4776 3708 cmd.exe 93 PID 3708 wrote to memory of 4776 3708 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe"C:\Users\Admin\AppData\Local\Temp\8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe"1⤵
- Suspicious behavior: RenamesItself
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2752 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3708 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:4776
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1060 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\8c9dc467eccf32b5061853ff899f1acd009916faa5d941f5c182676e67ea1152.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1676
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1928 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:4792
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\Test2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Test2.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3520 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\Test2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\Test2.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:4704
-
-