Analysis
-
max time kernel
151s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
02/12/2022, 20:40
Static task
static1
Behavioral task
behavioral1
Sample
b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe
Resource
win7-20220901-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe
-
Size
268KB
-
MD5
9533b0fa5939a68f2a0a43463e139913
-
SHA1
85a1a86a18ecfc0919992a6b445cc9afdaf328e3
-
SHA256
b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077
-
SHA512
b66b30476288e6655a18c984331ee5b0aadad6082767b5ca3565d32787b34b38eb08c16e217f4918acc9adea58145e93d21de210992b9a37576d6293d43b31d0
-
SSDEEP
3072:EoJUAqlBaEBx/pHXqv1KkZLE5UPC1NnaQ2D6czNZfMP3zFgpeBOyChpDvAcM6j:EztlsE5m/9PD6vgpGw7vhM6j
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\le pauvre.exe = "C:\\Users\\Admin\\AppData\\Roaming\\le pauvre.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4CF7BB0A-ACB1-0FCC-A042-3AAFAD9E4DC9} b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{4CF7BB0A-ACB1-0FCC-A042-3AAFAD9E4DC9}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\le pauvre.exe" b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{4CF7BB0A-ACB1-0FCC-A042-3AAFAD9E4DC9} b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{4CF7BB0A-ACB1-0FCC-A042-3AAFAD9E4DC9}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\le pauvre.exe" b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe -
resource yara_rule behavioral2/memory/4296-136-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4296-140-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4296-138-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4296-146-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4296-153-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2816 set thread context of 4296 2816 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 82 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 4240 reg.exe 2652 reg.exe 4232 reg.exe 2200 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeCreateTokenPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeAssignPrimaryTokenPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeLockMemoryPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeIncreaseQuotaPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeMachineAccountPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeTcbPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeSecurityPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeTakeOwnershipPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeLoadDriverPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeSystemProfilePrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeSystemtimePrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeProfSingleProcessPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeIncBasePriorityPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeCreatePagefilePrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeCreatePermanentPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeBackupPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeRestorePrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeShutdownPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeDebugPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeAuditPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeSystemEnvironmentPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeChangeNotifyPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeRemoteShutdownPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeUndockPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeSyncAgentPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeEnableDelegationPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeManageVolumePrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeImpersonatePrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeCreateGlobalPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: 31 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: 32 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: 33 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: 34 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: 35 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe Token: SeDebugPrivilege 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 2816 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 2816 wrote to memory of 4296 2816 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 82 PID 2816 wrote to memory of 4296 2816 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 82 PID 2816 wrote to memory of 4296 2816 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 82 PID 2816 wrote to memory of 4296 2816 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 82 PID 2816 wrote to memory of 4296 2816 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 82 PID 2816 wrote to memory of 4296 2816 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 82 PID 2816 wrote to memory of 4296 2816 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 82 PID 2816 wrote to memory of 4296 2816 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 82 PID 4296 wrote to memory of 5044 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 83 PID 4296 wrote to memory of 5044 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 83 PID 4296 wrote to memory of 5044 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 83 PID 4296 wrote to memory of 1424 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 84 PID 4296 wrote to memory of 1424 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 84 PID 4296 wrote to memory of 1424 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 84 PID 4296 wrote to memory of 2040 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 86 PID 4296 wrote to memory of 2040 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 86 PID 4296 wrote to memory of 2040 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 86 PID 4296 wrote to memory of 4020 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 89 PID 4296 wrote to memory of 4020 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 89 PID 4296 wrote to memory of 4020 4296 b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe 89 PID 2040 wrote to memory of 2652 2040 cmd.exe 92 PID 2040 wrote to memory of 2652 2040 cmd.exe 92 PID 2040 wrote to memory of 2652 2040 cmd.exe 92 PID 4020 wrote to memory of 2200 4020 cmd.exe 94 PID 4020 wrote to memory of 2200 4020 cmd.exe 94 PID 4020 wrote to memory of 2200 4020 cmd.exe 94 PID 5044 wrote to memory of 4232 5044 cmd.exe 93 PID 5044 wrote to memory of 4232 5044 cmd.exe 93 PID 5044 wrote to memory of 4232 5044 cmd.exe 93 PID 1424 wrote to memory of 4240 1424 cmd.exe 91 PID 1424 wrote to memory of 4240 1424 cmd.exe 91 PID 1424 wrote to memory of 4240 1424 cmd.exe 91
Processes
-
C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe"C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2816 -
C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exeC:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe2⤵
- Modifies Installed Components in the registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4296 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:5044 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4232
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\b6c24d2322531ac2eb87a9ba067dcfaa9231d6332950a83b9e0cd2f9705be077.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4240
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2040 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2652
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\le pauvre.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\le pauvre.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4020 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\le pauvre.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\le pauvre.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2200
-
-
-