Analysis
-
max time kernel
167s -
max time network
215s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
27-11-2022 19:07
Static task
static1
Behavioral task
behavioral1
Sample
59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166.exe
-
Size
314KB
-
MD5
e8ab73bd31591fa5337be49241f8a7d8
-
SHA1
c00ea2df72fe2ed1536e4f80edff39c7ff3a2f5a
-
SHA256
59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166
-
SHA512
d257b5a6ba7a20c8835fe5f0553a481e628f89893a96df8e07779c00db28294d736e66dd904c6618b85820af2394040711c0ea45aeaf1e6f05e983b82f56fd5e
-
SSDEEP
6144:CWQ8QntTwcMT0RyE0h2D9AxxTlNKDPj9q:tQfta0RaMA/mL5q
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\USER\S-1-5-21-2292972927-2705560509-2768824231-1000\Software\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{6CCA87B6-4362-473B-9778-4E5CB019562A}\\f5ea51da.exe" svchost.exe Key created \REGISTRY\MACHINE\Software\Wow6432Node\Microsoft\Windows\CurrentVersion\Run svchost.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\f5ea51da = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\{6CCA87B6-4362-473B-9778-4E5CB019562A}\\f5ea51da.exe" svchost.exe -
Drops file in System32 directory 1 IoCs
description ioc Process File created C:\Windows\system32\wbem\Performance\WmiApRpl_new.ini Process not Found -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe -
Suspicious behavior: MapViewOfSection 26 IoCs
pid Process 1952 59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166.exe 1952 59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe 1764 svchost.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeDebugPrivilege 1764 svchost.exe Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeSystemtimePrivilege 872 Process not Found Token: SeBackupPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeShutdownPrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeUndockPrivilege 872 Process not Found Token: SeManageVolumePrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found Token: SeLoadDriverPrivilege 872 Process not Found Token: SeRestorePrivilege 872 Process not Found Token: SeSystemEnvironmentPrivilege 872 Process not Found Token: SeAssignPrimaryTokenPrivilege 872 Process not Found Token: SeIncreaseQuotaPrivilege 872 Process not Found Token: SeSecurityPrivilege 872 Process not Found Token: SeTakeOwnershipPrivilege 872 Process not Found -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1256 Process not Found 1256 Process not Found -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1256 Process not Found 1256 Process not Found -
Suspicious use of UnmapMainImage 5 IoCs
pid Process 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found 808 Process not Found -
Suspicious use of WriteProcessMemory 4 IoCs
description pid Process procid_target PID 1952 wrote to memory of 1764 1952 59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166.exe 28 PID 1952 wrote to memory of 1764 1952 59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166.exe 28 PID 1952 wrote to memory of 1764 1952 59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166.exe 28 PID 1952 wrote to memory of 1764 1952 59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166.exe 28
Processes
-
C:\Users\Admin\AppData\Local\Temp\59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166.exe"C:\Users\Admin\AppData\Local\Temp\59dc9cc5a82526223151f33fc16e4c2698c1725c93f8f7186efda9463aa9f166.exe"1⤵
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1952 -
C:\Windows\SysWOW64\svchost.exe"C:\Windows\system32\svchost.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of AdjustPrivilegeToken
PID:1764
-