Analysis
-
max time kernel
155s -
max time network
160s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
24-11-2022 22:31
Static task
static1
Behavioral task
behavioral1
Sample
8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe
Resource
win10v2004-20220812-en
General
-
Target
8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe
-
Size
878KB
-
MD5
474144535ccb04b454b19991e2e3f539
-
SHA1
99cfa6fb38e203c41f36ba36ee71e941025a4f10
-
SHA256
8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c
-
SHA512
9848c753d4d9a4b09cbf94e45d1358362dec8b504cadac5885038b4d467b37ec860378348525250c8cab9d3f03e917aae242b7c45f7324c07d41294bc1e6aec2
-
SSDEEP
12288:NB1xhXJxtxC5E5oPmGUgzO6xWVbVyaRG1V8VFDt:NnzvTC5D+GIbVnRGYD
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
Processes:
8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exedescription ioc process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\M-5078860724647675945\winmgr.exe = "C:\\Users\\Admin\\M-5078860724647675945\\winmgr.exe:*:Enabled:Microsoft Windows Manager" 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe -
Executes dropped EXE 2 IoCs
Processes:
winmgr.exewinmgr.exepid process 5048 winmgr.exe 3600 winmgr.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\Software\Microsoft\Windows\CurrentVersion\Run\ 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft Windows Manager = "C:\\Users\\Admin\\M-5078860724647675945\\winmgr.exe" 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe -
Suspicious use of SetThreadContext 2 IoCs
Processes:
8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exewinmgr.exedescription pid process target process PID 1476 set thread context of 4888 1476 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe PID 5048 set thread context of 3600 5048 winmgr.exe winmgr.exe -
Suspicious behavior: MapViewOfSection 4 IoCs
Processes:
8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exewinmgr.exepid process 1476 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe 1476 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe 5048 winmgr.exe 5048 winmgr.exe -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exewinmgr.exedescription pid process target process PID 1476 wrote to memory of 4888 1476 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe PID 1476 wrote to memory of 4888 1476 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe PID 1476 wrote to memory of 4888 1476 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe PID 4888 wrote to memory of 5048 4888 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe winmgr.exe PID 4888 wrote to memory of 5048 4888 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe winmgr.exe PID 4888 wrote to memory of 5048 4888 8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe winmgr.exe PID 5048 wrote to memory of 3600 5048 winmgr.exe winmgr.exe PID 5048 wrote to memory of 3600 5048 winmgr.exe winmgr.exe PID 5048 wrote to memory of 3600 5048 winmgr.exe winmgr.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe"C:\Users\Admin\AppData\Local\Temp\8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1476 -
C:\Users\Admin\AppData\Local\Temp\8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe"C:\Users\Admin\AppData\Local\Temp\8c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c.exe"2⤵
- Modifies firewall policy service
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
PID:4888 -
C:\Users\Admin\M-5078860724647675945\winmgr.exeC:\Users\Admin\M-5078860724647675945\winmgr.exe3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:5048 -
C:\Users\Admin\M-5078860724647675945\winmgr.exeC:\Users\Admin\M-5078860724647675945\winmgr.exe4⤵
- Executes dropped EXE
PID:3600
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\M-5078860724647675945\winmgr.exeFilesize
878KB
MD5474144535ccb04b454b19991e2e3f539
SHA199cfa6fb38e203c41f36ba36ee71e941025a4f10
SHA2568c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c
SHA5129848c753d4d9a4b09cbf94e45d1358362dec8b504cadac5885038b4d467b37ec860378348525250c8cab9d3f03e917aae242b7c45f7324c07d41294bc1e6aec2
-
C:\Users\Admin\M-5078860724647675945\winmgr.exeFilesize
878KB
MD5474144535ccb04b454b19991e2e3f539
SHA199cfa6fb38e203c41f36ba36ee71e941025a4f10
SHA2568c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c
SHA5129848c753d4d9a4b09cbf94e45d1358362dec8b504cadac5885038b4d467b37ec860378348525250c8cab9d3f03e917aae242b7c45f7324c07d41294bc1e6aec2
-
C:\Users\Admin\M-5078860724647675945\winmgr.exeFilesize
878KB
MD5474144535ccb04b454b19991e2e3f539
SHA199cfa6fb38e203c41f36ba36ee71e941025a4f10
SHA2568c150909fa61c76f9a3ecb90934425f1b5c14c40805c535e627f0c315ec8e00c
SHA5129848c753d4d9a4b09cbf94e45d1358362dec8b504cadac5885038b4d467b37ec860378348525250c8cab9d3f03e917aae242b7c45f7324c07d41294bc1e6aec2
-
memory/3600-137-0x0000000000000000-mapping.dmp
-
memory/3600-139-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/4888-132-0x0000000000000000-mapping.dmp
-
memory/4888-133-0x0000000000400000-0x0000000000407000-memory.dmpFilesize
28KB
-
memory/5048-134-0x0000000000000000-mapping.dmp