Analysis
-
max time kernel
143s -
max time network
177s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
01/12/2022, 08:59
Static task
static1
Behavioral task
behavioral1
Sample
5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe
Resource
win7-20221111-en
windows7-x64
14 signatures
150 seconds
Behavioral task
behavioral2
Sample
5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
0 signatures
150 seconds
General
-
Target
5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe
-
Size
177KB
-
MD5
1d82234b88aa0cda3695f36b943eb647
-
SHA1
781b532c97ac7e90555cb272d3eae9f914fc9613
-
SHA256
5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c
-
SHA512
7d80956f0f8a0dc06948142bc1c37d43ff5d1d2446475ce07246545f2f4b2887af3785bb59fb81a323f048c84a87368646782a307c70be0dd8ecd0a80bb64c40
-
SSDEEP
3072:38Z/G4MhpabhLlDvVC5j6O7M0leLzt6aulE6DMyfIp1N/mbtZnyhIF+JZ:38Z/G4MhovVC5mO7flEzhAvMygp1lmH
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe -
Modifies security service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe -
Executes dropped EXE 2 IoCs
pid Process 1272 Explorer.EXE 460 services.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$f6ae883d87b28e9233b2e7745dda3830\\n." 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3385717845-2518323428-350143044-1000\\$f6ae883d87b28e9233b2e7745dda3830\\n." 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe -
Deletes itself 1 IoCs
pid Process 1828 cmd.exe -
Unexpected DNS network traffic destination 18 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 194.165.17.3 Destination IP 66.85.130.234 Destination IP 194.165.17.3 Destination IP 66.85.130.234 Destination IP 194.165.17.3 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 194.165.17.3 Destination IP 66.85.130.234 Destination IP 66.85.130.234 Destination IP 194.165.17.3 Destination IP 194.165.17.3 Destination IP 194.165.17.3 Destination IP 66.85.130.234 Destination IP 194.165.17.3 Destination IP 66.85.130.234 Destination IP 194.165.17.3 -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1156 set thread context of 1828 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 28 -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\clsid 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe Key created \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe Set value (str) \REGISTRY\USER\S-1-5-21-3385717845-2518323428-350143044-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3385717845-2518323428-350143044-1000\\$f6ae883d87b28e9233b2e7745dda3830\\n." 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$f6ae883d87b28e9233b2e7745dda3830\\n." 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1272 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 24 IoCs
description pid Process Token: SeDebugPrivilege 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe Token: SeDebugPrivilege 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe Token: SeDebugPrivilege 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeShutdownPrivilege 1272 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1272 Explorer.EXE 1272 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1156 wrote to memory of 1272 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 21 PID 1156 wrote to memory of 1272 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 21 PID 1156 wrote to memory of 460 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 2 PID 1156 wrote to memory of 1828 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 28 PID 1156 wrote to memory of 1828 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 28 PID 1156 wrote to memory of 1828 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 28 PID 1156 wrote to memory of 1828 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 28 PID 1156 wrote to memory of 1828 1156 5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe 28
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Suspicious use of AdjustPrivilegeToken
PID:460
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1272 -
C:\Users\Admin\AppData\Local\Temp\5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe"C:\Users\Admin\AppData\Local\Temp\5b973e6504e88c174a4c683b8d83a9221b063fa1fb794e2750cd36ebcba2378c.exe"2⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1156 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:1828
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d3585211df1be0f2d56ce8cc87e173b6
SHA168bd7538b34fab365033973f5fe49abc3ee0eae7
SHA256d1b64eeff4307de4262384600887bdfc389cea2590d1bd34a99f2189686a0dfa
SHA512a76df23d194059a465ca981f5f0ccd982d66f61d14de2ede8771b7f70f035b6f9368278a4ec479befd6b6e96098b16649045844b546747cf758b04fafa51709e
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5
-
Filesize
25KB
MD59e0cd37b6d0809cf7d5fa5b521538d0d
SHA1411ffdbe6c151dbd417bc59fa9dfec22b0adc9f2
SHA25655d9748f0556576a8d522cf4b8dcfc9717436adcc487d49b3320770432960db2
SHA512b511ee744dbe6cf0f54cb840d3786e89161115d0038425dde86d57752f76cae7a05f020120b43dc1444bd914c8c1690049e456635cc794fbf90e26794587dfc5