Analysis
-
max time kernel
46s -
max time network
47s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
06-11-2022 11:22
Static task
static1
Behavioral task
behavioral1
Sample
2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe
Resource
win7-20220812-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe
-
Size
548KB
-
MD5
168b217c270dcb252bdc3d5ad075b7be
-
SHA1
b7e51f26d272a2c3b0c5eccbe8146b11f4def0bc
-
SHA256
2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000
-
SHA512
2509af32202d95e79b724cea73fedb3942fe0690c90598e0d5f51c4cca71dd664b461b01df2abc6c14344b3c68cbb971c3742eccbb51f72d3cd1d098aab10130
-
SSDEEP
6144:K2681WUqicX91Ch5ygR0CiKGgITLkuxY1Sc8lMjN7C7Zc7zaFnjY:KlTicX9MkgR0CtG6ZBjNm14zai
Score
9/10
Malware Config
Signatures
-
Grants admin privileges 1 TTPs
Uses net.exe to modify the user's privileges.
-
Enumerates system info in registry 2 TTPs 32 IoCs
description ioc Process Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Configuration Data csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\1\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Component Information csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Identifier csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Identifier csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\Configuration Data csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\Component Information csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Configuration Data csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2 csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\1\Identifier csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController csrss.exe Key queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral csrss.exe Key enumerated \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\2\Component Information csrss.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\SYSTEM\MultifunctionAdapter\0\KeyboardController\0 csrss.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\MultifunctionAdapter\0\KeyboardController\0\KeyboardPeripheral\0\Component Information csrss.exe -
Modifies data under HKEY_USERS 9 IoCs
description ioc Process Set value (data) \REGISTRY\USER\.DEFAULT\Control Panel\Desktop\MuiCached\MachinePreferredUILanguages = 65006e002d00550053000000 winlogon.exe Key created \REGISTRY\USER\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\ThemeManager winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ThemeActive = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\SizeName = "NormalSize" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LoadedBefore = "1" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastUserLangID = "1033" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\LastLoadedDPI = "96" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\DllName = "%SystemRoot%\\resources\\themes\\Aero\\Aero.msstyles" winlogon.exe Set value (str) \REGISTRY\USER\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\ThemeManager\ColorName = "NormalColor" winlogon.exe -
Runs net.exe
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeShutdownPrivilege 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe Token: SeShutdownPrivilege 988 LogonUI.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe -
Suspicious use of WriteProcessMemory 37 IoCs
description pid Process procid_target PID 668 wrote to memory of 1772 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 28 PID 668 wrote to memory of 1772 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 28 PID 668 wrote to memory of 1772 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 28 PID 668 wrote to memory of 1772 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 28 PID 1772 wrote to memory of 1908 1772 net.exe 30 PID 1772 wrote to memory of 1908 1772 net.exe 30 PID 1772 wrote to memory of 1908 1772 net.exe 30 PID 1772 wrote to memory of 1908 1772 net.exe 30 PID 668 wrote to memory of 1080 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 31 PID 668 wrote to memory of 1080 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 31 PID 668 wrote to memory of 1080 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 31 PID 668 wrote to memory of 1080 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 31 PID 1080 wrote to memory of 816 1080 net.exe 33 PID 1080 wrote to memory of 816 1080 net.exe 33 PID 1080 wrote to memory of 816 1080 net.exe 33 PID 1080 wrote to memory of 816 1080 net.exe 33 PID 668 wrote to memory of 2000 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 34 PID 668 wrote to memory of 2000 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 34 PID 668 wrote to memory of 2000 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 34 PID 668 wrote to memory of 2000 668 2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe 34 PID 2000 wrote to memory of 1632 2000 net.exe 36 PID 2000 wrote to memory of 1632 2000 net.exe 36 PID 2000 wrote to memory of 1632 2000 net.exe 36 PID 2000 wrote to memory of 1632 2000 net.exe 36 PID 1904 wrote to memory of 988 1904 csrss.exe 41 PID 1904 wrote to memory of 988 1904 csrss.exe 41 PID 1936 wrote to memory of 988 1936 winlogon.exe 41 PID 1936 wrote to memory of 988 1936 winlogon.exe 41 PID 1936 wrote to memory of 988 1936 winlogon.exe 41 PID 1904 wrote to memory of 988 1904 csrss.exe 41 PID 1904 wrote to memory of 988 1904 csrss.exe 41 PID 1904 wrote to memory of 988 1904 csrss.exe 41 PID 1904 wrote to memory of 988 1904 csrss.exe 41 PID 1904 wrote to memory of 988 1904 csrss.exe 41 PID 1904 wrote to memory of 988 1904 csrss.exe 41 PID 1904 wrote to memory of 988 1904 csrss.exe 41 PID 1904 wrote to memory of 988 1904 csrss.exe 41
Processes
-
C:\Users\Admin\AppData\Local\Temp\2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe"C:\Users\Admin\AppData\Local\Temp\2626cd04569038478f4bc5d2669c5a1aece142d17a807fc5be8344f51c9a2000.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:668 -
C:\Windows\SysWOW64\net.exenet user administrator 8116301872⤵
- Suspicious use of WriteProcessMemory
PID:1772 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user administrator 8116301873⤵PID:1908
-
-
-
C:\Windows\SysWOW64\net.exenet user ÒªÃÜÂë¼Ó1308722504 811630187 /add2⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 user ÒªÃÜÂë¼Ó1308722504 811630187 /add3⤵PID:816
-
-
-
C:\Windows\SysWOW64\net.exenet localgroup administrators ÒªÃÜÂë¼Ó1308722504 /add2⤵
- Suspicious use of WriteProcessMemory
PID:2000 -
C:\Windows\SysWOW64\net1.exeC:\Windows\system32\net1 localgroup administrators ÒªÃÜÂë¼Ó1308722504 /add3⤵PID:1632
-
-
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵PID:684
-
C:\Windows\system32\csrss.exe%SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=161⤵
- Enumerates system info in registry
- Suspicious use of WriteProcessMemory
PID:1904
-
C:\Windows\system32\winlogon.exewinlogon.exe1⤵
- Modifies data under HKEY_USERS
- Suspicious use of WriteProcessMemory
PID:1936 -
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x02⤵
- Suspicious use of AdjustPrivilegeToken
PID:988
-