Analysis
-
max time kernel
148s -
max time network
146s -
platform
windows7_x64 -
resource
win7-20220901-en -
resource tags
arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system -
submitted
02/12/2022, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe
-
Size
268KB
-
MD5
9533b0fa5939a68f2a0a43463e139913
-
SHA1
85a1a86a18ecfc0919992a6b445cc9afdaf328e3
-
SHA256
b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077
-
SHA512
b66b30476288e6655a18c984331ee5b0aadad6082767b5ca3565d32787b34b38eb08c16e217f4918acc9adea58145e93d21de210992b9a37576d6293d43b31d0
-
SSDEEP
3072:EoJUAqlBaEBx/pHXqv1KkZLE5UPC1NnaQ2D6czNZfMP3zFgpeBOyChpDvAcM6j:EztlsE5m/9PD6vgpGw7vhM6j
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 8 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\le pauvre.exe = "C:\\Users\\Admin\\AppData\\Roaming\\le pauvre.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4CF7BB0A-ACB1-0FCC-A042-3AAFAD9E4DC9} b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Active Setup\Installed Components\{4CF7BB0A-ACB1-0FCC-A042-3AAFAD9E4DC9}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\le pauvre.exe" b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Key created \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{4CF7BB0A-ACB1-0FCC-A042-3AAFAD9E4DC9} b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Set value (str) \REGISTRY\USER\S-1-5-21-4063495947-34355257-727531523-1000\Software\Microsoft\Active Setup\Installed Components\{4CF7BB0A-ACB1-0FCC-A042-3AAFAD9E4DC9}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\le pauvre.exe" b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe -
resource yara_rule behavioral1/memory/1116-58-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1116-60-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1116-61-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1116-64-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1116-66-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1116-79-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral1/memory/1116-80-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1464 set thread context of 1116 1464 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 27 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1824 reg.exe 1552 reg.exe 924 reg.exe 812 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeCreateTokenPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeAssignPrimaryTokenPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeLockMemoryPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeIncreaseQuotaPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeMachineAccountPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeTcbPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeSecurityPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeTakeOwnershipPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeLoadDriverPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeSystemProfilePrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeSystemtimePrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeProfSingleProcessPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeIncBasePriorityPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeCreatePagefilePrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeCreatePermanentPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeBackupPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeRestorePrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeShutdownPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeDebugPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeAuditPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeSystemEnvironmentPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeChangeNotifyPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeRemoteShutdownPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeUndockPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeSyncAgentPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeEnableDelegationPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeManageVolumePrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeImpersonatePrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeCreateGlobalPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: 31 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: 32 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: 33 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: 34 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: 35 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeDebugPrivilege 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 1464 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe -
Suspicious use of WriteProcessMemory 40 IoCs
description pid Process procid_target PID 1464 wrote to memory of 1116 1464 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 27 PID 1464 wrote to memory of 1116 1464 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 27 PID 1464 wrote to memory of 1116 1464 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 27 PID 1464 wrote to memory of 1116 1464 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 27 PID 1464 wrote to memory of 1116 1464 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 27 PID 1464 wrote to memory of 1116 1464 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 27 PID 1464 wrote to memory of 1116 1464 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 27 PID 1464 wrote to memory of 1116 1464 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 27 PID 1116 wrote to memory of 840 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 28 PID 1116 wrote to memory of 840 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 28 PID 1116 wrote to memory of 840 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 28 PID 1116 wrote to memory of 840 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 28 PID 1116 wrote to memory of 1316 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 30 PID 1116 wrote to memory of 1316 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 30 PID 1116 wrote to memory of 1316 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 30 PID 1116 wrote to memory of 1316 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 30 PID 1116 wrote to memory of 1472 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 36 PID 1116 wrote to memory of 1472 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 36 PID 1116 wrote to memory of 1472 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 36 PID 1116 wrote to memory of 1472 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 36 PID 1116 wrote to memory of 584 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 32 PID 1116 wrote to memory of 584 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 32 PID 1116 wrote to memory of 584 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 32 PID 1116 wrote to memory of 584 1116 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 32 PID 840 wrote to memory of 1824 840 cmd.exe 35 PID 840 wrote to memory of 1824 840 cmd.exe 35 PID 840 wrote to memory of 1824 840 cmd.exe 35 PID 840 wrote to memory of 1824 840 cmd.exe 35 PID 1316 wrote to memory of 1552 1316 cmd.exe 37 PID 1316 wrote to memory of 1552 1316 cmd.exe 37 PID 1316 wrote to memory of 1552 1316 cmd.exe 37 PID 1316 wrote to memory of 1552 1316 cmd.exe 37 PID 1472 wrote to memory of 812 1472 cmd.exe 39 PID 1472 wrote to memory of 812 1472 cmd.exe 39 PID 1472 wrote to memory of 812 1472 cmd.exe 39 PID 1472 wrote to memory of 812 1472 cmd.exe 39 PID 584 wrote to memory of 924 584 cmd.exe 38 PID 584 wrote to memory of 924 584 cmd.exe 38 PID 584 wrote to memory of 924 584 cmd.exe 38 PID 584 wrote to memory of 924 584 cmd.exe 38
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe"C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1464 -
C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exeC:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe2⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1116 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:840 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1824
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1316 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1552
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\le pauvre.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\le pauvre.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:584 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\le pauvre.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\le pauvre.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:924
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1472 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:812
-
-
-