Analysis
- max time kernel
151s - max time network
151s - platform
windows7_x64 - resource
win7-20220812-en - resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system - submitted
08/11/2022, 05:03
Static task
static1
Behavioral task
behavioral1
Sample
aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
Resource
win7-20220812-en
windows7-x64
11 signatures
150 seconds
Behavioral task
behavioral2
Sample
aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe
- Size 344KB
- Sample221108-fp5bvshdc3
- SHA256 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3
- MD5 14a20867d0d6519be768b17ad3cefefe
- SHA1 c955e587f0f84df8cfd27b23f70be1de11253b29
- SHA512 69b50b95e59ccd2e19577e22560edff5d63c844558b05456481c83d7678dff50a99798ff7132b0aeb728795f14fe77222096a3b5e2296fdb80b95ca310f2807e
- SSDEEP 6144:RerQu7SGFRDauuLk8fk3tdG2smOOHhmlbobTfCF9NRRya6AE7Gya6AE:UcKSyQ2dBhhmlbot
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies security service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\MpsSvc\Parameters\PortKeywords\DHCP Process not Found Set value (data) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP\Collection Process not Found - Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{9AF9AF3D-F414-4370-8F12-36313A2E5ADA}\\f5ea51da.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{9AF9AF3D-F414-4370-8F12-36313A2E5ADA}\\f5ea51da.exe" svchost.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe - Suspicious behavior: MapViewOfSection 26 IoCs
pid Process 1992 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe 1992 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe 1720 svchost.exe - Suspicious use of AdjustPrivilegeToken 61 IoCs
description pid Process Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeDebugPrivilege 1720 svchost.exe Token: SeAssignPrimaryTokenPrivilege 880 Process not Found Token: SeIncreaseQuotaPrivilege 880 Process not Found Token: SeSecurityPrivilege 880 Process not Found Token: SeTakeOwnershipPrivilege 880 Process not Found Token: SeLoadDriverPrivilege 880 Process not Found Token: SeRestorePrivilege 880 Process not Found Token: SeSystemEnvironmentPrivilege 880 Process not Found Token: SeAssignPrimaryTokenPrivilege 880 Process not Found Token: SeIncreaseQuotaPrivilege 880 Process not Found Token: SeSecurityPrivilege 880 Process not Found Token: SeTakeOwnershipPrivilege 880 Process not Found Token: SeLoadDriverPrivilege 880 Process not Found Token: SeSystemtimePrivilege 880 Process not Found Token: SeBackupPrivilege 880 Process not Found Token: SeRestorePrivilege 880 Process not Found Token: SeShutdownPrivilege 880 Process not Found Token: SeSystemEnvironmentPrivilege 880 Process not Found Token: SeUndockPrivilege 880 Process not Found Token: SeManageVolumePrivilege 880 Process not Found Token: SeAssignPrimaryTokenPrivilege 880 Process not Found Token: SeIncreaseQuotaPrivilege 880 Process not Found Token: SeSecurityPrivilege 880 Process not Found Token: SeTakeOwnershipPrivilege 880 Process not Found Token: SeLoadDriverPrivilege 880 Process not Found Token: SeRestorePrivilege 880 Process not Found Token: SeSystemEnvironmentPrivilege 880 Process not Found Token: SeAssignPrimaryTokenPrivilege 880 Process not Found Token: SeIncreaseQuotaPrivilege 880 Process not Found Token: SeSecurityPrivilege 880 Process not Found Token: SeTakeOwnershipPrivilege 880 Process not Found Token: SeLoadDriverPrivilege 880 Process not Found Token: SeRestorePrivilege 880 Process not Found Token: SeSystemEnvironmentPrivilege 880 Process not Found Token: SeAuditPrivilege 880 Process not Found - Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1224 Process not Found 1224 Process not Found - Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1224 Process not Found 1224 Process not Found - Suspicious use of SetWindowsHookEx 1 IoCs
pid Process 1992 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe - Suspicious use of UnmapMainImage 5 IoCs
pid Process 1992 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe 816 Process not Found 816 Process not Found 816 Process not Found 816 Process not Found - Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1992 wrote to memory of 1720 1992 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe 28 PID 1992 wrote to memory of 1720 1992 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe 28 PID 1992 wrote to memory of 1720 1992 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe 28 PID 1992 wrote to memory of 1720 1992 aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe"C:\Users\Admin\AppData\Local\Temp\aa368679c530fc2019fe5467eb973a17c4b37c395288781b0a32c20e40a360d3.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1992 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1720
-