Analysis
-
max time kernel
27s -
max time network
154s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
03/12/2022, 06:56
Static task
static1
Behavioral task
behavioral1
Sample
b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe
Resource
win7-20220812-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe
-
Size
187KB
-
MD5
e53a81a5aa5eefd5b6925c361af697c8
-
SHA1
d1768d7ea1f26f68fe4b680643987fedcbe82367
-
SHA256
b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee
-
SHA512
67a2a7ecd40a02665c6cfa363c8b95188427780123082c074f16feb291f64bd212ffef0be6226a0a75bebd0b19902d24f51c2904109b72e79d36ac23f136c019
-
SSDEEP
3072:i9EyZc5bluac4EbLWQBThIX7uNYzuGb2po4iXQl4jru71Zoj5JU:i9fqGDXLWQZhq7Z6i40Psov
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 18 IoCs
description ioc Process Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\FirewallRules services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static\System services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\AuthorizedApplications services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Configurable services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\PublicProfile\Logging services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\RestrictedServices\Static services.exe -
Modifies security service 2 TTPs 26 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\DHCP services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSOut services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\Teredo services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\DeleteFlag = "1" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Start = "4" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\DeleteFlag = "1" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\IPTLSIn services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Parameters\PortKeywords\RPC-EPMap services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Type = "32" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo\0 services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\TriggerInfo services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Type = "32" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\MpsSvc\Type = "32" services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\ErrorControl = "0" services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Parameters services.exe Key deleted \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\WinDefend\Security services.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\wscsvc\ErrorControl = "0" services.exe -
Deletes itself 1 IoCs
pid Process 1788 cmd.exe -
Unexpected DNS network traffic destination 6 IoCs
Network traffic to other servers than the configured DNS servers was detected on the DNS port.
description ioc Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 Destination IP 83.133.123.20 -
Drops desktop.ini file(s) 2 IoCs
description ioc Process File created \systemroot\assembly\GAC_32\Desktop.ini services.exe File created \systemroot\assembly\GAC_64\Desktop.ini services.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 1760 set thread context of 1788 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 28 -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\Installer\{a31e499c-3c7c-222a-40fd-7fc6e142514c}\@ b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe -
Suspicious behavior: EnumeratesProcesses 7 IoCs
pid Process 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 464 services.exe 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe -
Suspicious use of AdjustPrivilegeToken 28 IoCs
description pid Process Token: SeDebugPrivilege 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe Token: SeDebugPrivilege 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe Token: SeDebugPrivilege 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe Token: SeDebugPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe Token: SeBackupPrivilege 464 services.exe Token: SeRestorePrivilege 464 services.exe Token: SeSecurityPrivilege 464 services.exe Token: SeTakeOwnershipPrivilege 464 services.exe -
Suspicious use of FindShellTrayWindow 2 IoCs
pid Process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 2 IoCs
pid Process 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 7 IoCs
description pid Process procid_target PID 1760 wrote to memory of 1260 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 16 PID 1760 wrote to memory of 464 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 2 PID 1760 wrote to memory of 1788 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 28 PID 1760 wrote to memory of 1788 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 28 PID 1760 wrote to memory of 1788 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 28 PID 1760 wrote to memory of 1788 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 28 PID 1760 wrote to memory of 1788 1760 b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe 28
Processes
-
C:\Windows\system32\services.exeC:\Windows\system32\services.exe1⤵
- Modifies firewall policy service
- Modifies security service
- Drops desktop.ini file(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:464
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe"C:\Users\Admin\AppData\Local\Temp\b50d186d68774194056ac63a63f81e14f555cfad2831888a0ae47fa19af90cee.exe"2⤵
- Suspicious use of SetThreadContext
- Drops file in Windows directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1760 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\system32\cmd.exe"3⤵
- Deletes itself
PID:1788
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
2KB
MD5ce346d834e1bcccc34763a22547fb6b6
SHA143668d0644e2acd4e258ac1fff6b28a7bfd612e7
SHA256b7be91a32eaf7a137153b680e9112b70ae3cd84f32e723c4201580ba85cec0ec
SHA51242d0234b3260fa626002da93726c751c32552885f68901c278ac9cc0ea1d0dd07eff68563c57f8e16fa1913fd3bea255124f4739e3cb88820915b5acaae80b83