Analysis
-
max time kernel
164s -
max time network
193s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
29/11/2022, 08:03
Static task
static1
Behavioral task
behavioral1
Sample
6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe
Resource
win7-20221111-en
windows7-x64
13 signatures
150 seconds
Behavioral task
behavioral2
Sample
6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
1 signatures
150 seconds
General
-
Target
6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe
-
Size
178KB
-
MD5
727cf305772860abd334c71d7bc36059
-
SHA1
ed9da02796cec03459453485dd44858dda180938
-
SHA256
6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615
-
SHA512
26ab7384dbff320132d4d9501456d3ef88e5045cfdf48ef097849f61fab4ea8655e8c07c3d3926500c07e0ddd33291005c7c926db4596e96c600de58a6c6c56a
-
SSDEEP
3072:5lZeYd+OK4GoCsMQFG+jpAjhMLtnpSjX/1UTyHXgBmJQHOmBODE6TGquD5csHUHK:5rld+O6slgGpmhMhUjaXBQQdB2Cb3LF3
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe -
Modifies security service 2 TTPs 26 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe -
Deletes itself 1 IoCs
pid Process 1988 cmd.exe -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_32\Desktop.ini services.exe File created \systemroot\assembly\GAC_64\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1140 set thread context of 1988 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 28 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Installer\{f6ae883d-87b2-8e92-33b2-e7745dda3830}\@ 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 460 services.exe 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1284 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 29 IoCs
description pid Process Token: SeDebugPrivilege 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe Token: SeDebugPrivilege 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe Token: SeDebugPrivilege 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe Token: SeDebugPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeShutdownPrivilege 1284 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1284 Explorer.EXE 1284 Explorer.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1140 wrote to memory of 1284 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 10 PID 1140 wrote to memory of 460 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 2 PID 1140 wrote to memory of 1988 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 28 PID 1140 wrote to memory of 1988 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 28 PID 1140 wrote to memory of 1988 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 28 PID 1140 wrote to memory of 1988 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 28 PID 1140 wrote to memory of 1988 1140 6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe 28
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1284 -
C:\Users\Admin\AppData\Local\Temp\6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe"C:\Users\Admin\AppData\Local\Temp\6eb5f18896abf80b4038bc6650196d8017959bd6963af27225f2e10762497615.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1140 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:1988
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD565cedd9a38f543f68bc5fc3b73530130
SHA1dfc15ba0f232349bbad3631250a5f3c11f19e50d
SHA2567da66402c78e584b5db02a04e64eea958e050058e0d6d74068c4c4a41693e320
SHA512d553775e2896926f68973bb93bbd8d04743eef75f109414a825266dd612eaefaaa94575f22d449494cb6ec61b588eb73d0135935bcd439eefcce50ba77ef9017