Analysis
-
max time kernel
165s -
max time network
213s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 06:25
Static task
static1
Behavioral task
behavioral1
Sample
baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe
Resource
win7-20221111-en
windows7-x64
15 signatures
150 seconds
Behavioral task
behavioral2
Sample
baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe
-
Size
213KB
-
MD5
39f524f427276be06111a023a5eb3dda
-
SHA1
97d45ccb4b9819de23accb0707043a2681bfedeb
-
SHA256
baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334
-
SHA512
5dfb53adcafdd30887d2b4492e859a458f0a93dd5579f31dffbe8f3d6f8e432f02ceda957baf57ba4b5538b2a2e9561db7e5c4a473a90ad01cd5ce4de906124b
-
SSDEEP
6144:XinTUy3cAG/eXVLOPWmO7cM5oWz0xZZkfy/K/o+:6TU1mXVKO7P5lA2d
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe -
Modifies security service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe -
Executes dropped EXE 2 IoCs
pid Process 1244 Explorer.EXE 460 services.exe -
Registers COM server for autorun 1 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3406023954-474543476-3319432036-1000\\$8c508dde2ce992e35b79435a5d2d0943\\n." baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$8c508dde2ce992e35b79435a5d2d0943\\n." baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe -
Deletes itself 1 IoCs
pid Process 624 cmd.exe -
Unexpected DNS network traffic destination 9 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_64\Desktop.ini services.exe File created \systemroot\assembly\GAC_32\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1392 set thread context of 624 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 28 -
Modifies registry class 6 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\clsid baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9} baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ThreadingModel = "Both" baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000_CLASSES\CLSID\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-21-3406023954-474543476-3319432036-1000\\$8c508dde2ce992e35b79435a5d2d0943\\n." baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\ = "C:\\$Recycle.Bin\\S-1-5-18\\$8c508dde2ce992e35b79435a5d2d0943\\n." baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 460 services.exe 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 1244 Explorer.EXE -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeDebugPrivilege 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe Token: SeDebugPrivilege 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe Token: SeDebugPrivilege 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe Token: SeDebugPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeBackupPrivilege 460 services.exe Token: SeRestorePrivilege 460 services.exe Token: SeSecurityPrivilege 460 services.exe Token: SeTakeOwnershipPrivilege 460 services.exe Token: SeShutdownPrivilege 1244 Explorer.EXE -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1244 Explorer.EXE 1244 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
description pid Process procid_target PID 1392 wrote to memory of 1244 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 11 PID 1392 wrote to memory of 1244 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 11 PID 1392 wrote to memory of 460 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 2 PID 1392 wrote to memory of 624 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 28 PID 1392 wrote to memory of 624 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 28 PID 1392 wrote to memory of 624 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 28 PID 1392 wrote to memory of 624 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 28 PID 1392 wrote to memory of 624 1392 baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe 28
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Executes dropped EXE
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:460
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Executes dropped EXE
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1244 -
C:\Users\Admin\AppData\Local\Temp\baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe"C:\Users\Admin\AppData\Local\Temp\baa6615943306b28442a2afeaeaca01d5b55095349f953a38e7f53dfdcedf334.exe"2⤵
- Registers COM server for autorun
- Suspicious use of SetThreadContext
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:624
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5d4a696dea01b5589c5637e48505495ba
SHA1f6ef9f86b11b649d2c5919a44cce8b00f822d2b8
SHA256dd56cf56048ed77af39ca3c007929448566cd31979ca986140efce7045c760e2
SHA5122af02e706924a66ed03f0b62369b4822328964a7299f919dff726a9ee5cef6828fc0abf1df704a92accb6d129763fe486519624161b5e15641ba2f9a48c600f7
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2
-
Filesize
41KB
MD5fb4e3236959152a057bc6b7603c538ef
SHA1b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4
SHA2568244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0
SHA512993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2