Analysis
-
max time kernel
169s -
max time network
182s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 00:54
Behavioral task
behavioral1
Sample
cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe
Resource
win7-20220901-en
windows7-x64
9 signatures
150 seconds
Behavioral task
behavioral2
Sample
cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
9 signatures
150 seconds
General
-
Target
cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe
-
Size
162KB
-
MD5
76e7a9d2b3816aad07a8eace3ac86259
-
SHA1
89054da7605601641318b9069f0794c571c4d99c
-
SHA256
cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f
-
SHA512
98df68fe6286cb49314de83ff280af46d5d0eae51576935b3b54a929c0a4f634bc83f89e69fa9315d9d07813cc88fd73618a751832b1e3591a30794b5834a256
-
SSDEEP
3072:VGC4mTElLZ9Ig4T2E52U6OyMNPQTHgnW6A4SlU5Mkm/7p9rzk3qq3T:VWmIlLZOg4B52UNpPtnW5HzjkawT
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\/testbs\testbs.exe = "C:\\Users\\Admin\\AppData\\Roaming\\/testbs\\testbs.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\testbs = "C:\\Users\\Admin\\AppData\\Roaming\\/testbs\\testbs.exe" cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8DD70CF-BE85-ACEE-1CAC-BF5756FBE02C} cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{F8DD70CF-BE85-ACEE-1CAC-BF5756FBE02C}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\/testbs\\testbs.exe" cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{F8DD70CF-BE85-ACEE-1CAC-BF5756FBE02C} cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{F8DD70CF-BE85-ACEE-1CAC-BF5756FBE02C}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\/testbs\\testbs.exe" cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe -
resource yara_rule behavioral2/memory/5032-132-0x0000000000400000-0x0000000000473000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\testbs = "C:\\Users\\Admin\\AppData\\Roaming\\/testbs\\testbs.exe" cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\testbs = "C:\\Users\\Admin\\AppData\\Roaming\\/testbs\\testbs.exe" cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1912 reg.exe 1556 reg.exe 4140 reg.exe 3008 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeCreateTokenPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeAssignPrimaryTokenPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeLockMemoryPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeIncreaseQuotaPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeMachineAccountPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeTcbPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeSecurityPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeTakeOwnershipPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeLoadDriverPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeSystemProfilePrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeSystemtimePrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeProfSingleProcessPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeIncBasePriorityPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeCreatePagefilePrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeCreatePermanentPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeBackupPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeRestorePrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeShutdownPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeDebugPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeAuditPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeSystemEnvironmentPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeChangeNotifyPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeRemoteShutdownPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeUndockPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeSyncAgentPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeEnableDelegationPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeManageVolumePrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeImpersonatePrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: SeCreateGlobalPrivilege 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: 31 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: 32 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: 33 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: 34 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe Token: 35 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 5032 wrote to memory of 4528 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 82 PID 5032 wrote to memory of 4528 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 82 PID 5032 wrote to memory of 4528 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 82 PID 5032 wrote to memory of 4904 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 83 PID 5032 wrote to memory of 4904 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 83 PID 5032 wrote to memory of 4904 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 83 PID 5032 wrote to memory of 624 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 86 PID 5032 wrote to memory of 624 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 86 PID 5032 wrote to memory of 624 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 86 PID 5032 wrote to memory of 1440 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 88 PID 5032 wrote to memory of 1440 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 88 PID 5032 wrote to memory of 1440 5032 cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe 88 PID 4528 wrote to memory of 4140 4528 cmd.exe 90 PID 4528 wrote to memory of 4140 4528 cmd.exe 90 PID 4528 wrote to memory of 4140 4528 cmd.exe 90 PID 624 wrote to memory of 3008 624 cmd.exe 91 PID 624 wrote to memory of 3008 624 cmd.exe 91 PID 624 wrote to memory of 3008 624 cmd.exe 91 PID 4904 wrote to memory of 1912 4904 cmd.exe 92 PID 4904 wrote to memory of 1912 4904 cmd.exe 92 PID 4904 wrote to memory of 1912 4904 cmd.exe 92 PID 1440 wrote to memory of 1556 1440 cmd.exe 93 PID 1440 wrote to memory of 1556 1440 cmd.exe 93 PID 1440 wrote to memory of 1556 1440 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe"C:\Users\Admin\AppData\Local\Temp\cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:5032 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4528 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:4140
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4904 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\cd4c72aefeaf745519b6a1e6949f34574513a212937389f6f1c54c8d054ef61f.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1912
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:624 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3008
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\/testbs\testbs.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\/testbs\testbs.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1440 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\/testbs\testbs.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\/testbs\testbs.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1556
-
-