Analysis
-
max time kernel
190s -
max time network
229s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 22:35
Static task
static1
Behavioral task
behavioral1
Sample
1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936.exe
Resource
win7-20221111-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
6 signatures
150 seconds
General
-
Target
1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936.exe
-
Size
275KB
-
MD5
d891cbbaf7fd229445a507bd8407fd96
-
SHA1
535501fbe60ff96890f46b1e2321c9bd0d25c4aa
-
SHA256
1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936
-
SHA512
86de8aa1da926d1b50cf329dfbbf0d67bf033e73323421c399c80c502cd3e1f92091864c14f9e5bc14f89db9cbe85cd8c0ec7896c3c581b40d4efd09b9631d35
-
SSDEEP
6144:JBgedih3DLc2g4DEqXqAUTBqd/20dkMzTL7AQ05lmtLrD6LrD6deOHNHXE/Nn719:JSedyzLc8EqeTsdOHf7QlvrT6O2Bqnuq
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{DF332CAE-8144-451B-B584-16E5BA40E4DD}\\f5ea51da.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{DF332CAE-8144-451B-B584-16E5BA40E4DD}\\f5ea51da.exe" svchost.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1256 Process not Found -
Suspicious behavior: MapViewOfSection 26 IoCs
pid Process 1616 1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936.exe 1616 1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe 884 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeDebugPrivilege 884 svchost.exe Token: SeAssignPrimaryTokenPrivilege 868 Process not Found Token: SeIncreaseQuotaPrivilege 868 Process not Found Token: SeSecurityPrivilege 868 Process not Found Token: SeTakeOwnershipPrivilege 868 Process not Found Token: SeLoadDriverPrivilege 868 Process not Found Token: SeRestorePrivilege 868 Process not Found Token: SeSystemEnvironmentPrivilege 868 Process not Found Token: SeAssignPrimaryTokenPrivilege 868 Process not Found Token: SeIncreaseQuotaPrivilege 868 Process not Found Token: SeSecurityPrivilege 868 Process not Found Token: SeTakeOwnershipPrivilege 868 Process not Found Token: SeLoadDriverPrivilege 868 Process not Found Token: SeSystemtimePrivilege 868 Process not Found Token: SeBackupPrivilege 868 Process not Found Token: SeRestorePrivilege 868 Process not Found Token: SeShutdownPrivilege 868 Process not Found Token: SeSystemEnvironmentPrivilege 868 Process not Found Token: SeUndockPrivilege 868 Process not Found Token: SeManageVolumePrivilege 868 Process not Found Token: SeAssignPrimaryTokenPrivilege 868 Process not Found Token: SeIncreaseQuotaPrivilege 868 Process not Found Token: SeSecurityPrivilege 868 Process not Found Token: SeTakeOwnershipPrivilege 868 Process not Found Token: SeLoadDriverPrivilege 868 Process not Found Token: SeRestorePrivilege 868 Process not Found Token: SeSystemEnvironmentPrivilege 868 Process not Found Token: SeAssignPrimaryTokenPrivilege 868 Process not Found Token: SeIncreaseQuotaPrivilege 868 Process not Found Token: SeSecurityPrivilege 868 Process not Found Token: SeTakeOwnershipPrivilege 868 Process not Found Token: SeLoadDriverPrivilege 868 Process not Found Token: SeRestorePrivilege 868 Process not Found Token: SeSystemEnvironmentPrivilege 868 Process not Found Token: SeAssignPrimaryTokenPrivilege 868 Process not Found Token: SeIncreaseQuotaPrivilege 868 Process not Found Token: SeSecurityPrivilege 868 Process not Found Token: SeTakeOwnershipPrivilege 868 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1256 Process not Found 1256 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1256 Process not Found 1256 Process not Found -
Suspicious use of UnmapMainImage 7 IoCs
pid Process 800 Process not Found 800 Process not Found 800 Process not Found 800 Process not Found 800 Process not Found 800 Process not Found 1256 Process not Found -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1616 wrote to memory of 884 1616 1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936.exe 28 PID 1616 wrote to memory of 884 1616 1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936.exe 28 PID 1616 wrote to memory of 884 1616 1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936.exe 28 PID 1616 wrote to memory of 884 1616 1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936.exe"C:\Users\Admin\AppData\Local\Temp\1c2d21587eb949fe719ae9499e42381d4250a0be5c770ea707a362afdd171936.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1616 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:884
-