Analysis
-
max time kernel
152s -
max time network
136s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
04/12/2022, 11:58
Static task
static1
Behavioral task
behavioral1
Sample
ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe
Resource
win7-20220812-en
windows7-x64
4 signatures
150 seconds
Behavioral task
behavioral2
Sample
ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe
-
Size
69KB
-
MD5
c3c182b358c4534ea98458cf4d92bf90
-
SHA1
5d4651eb649a407db88a6d3c3a46cc5afe087cbe
-
SHA256
ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0
-
SHA512
6a9d801e23f16d046d74ac06d781e1069082302e65e9b97f2647113d3bf884980bb8f6f1ff8e5c8e49e93bb12c0dddadf7aadb49cd9a182e8a78501c885ac9ed
-
SSDEEP
1536:fzhQO2g3GWX8Tqn7UfqQyYMqRRmTeHkwLCEXK:fzhQO2dw847UiIzHkwuEXK
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\TXMouie = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe -
Sets file execution options in registry 2 TTPs 64 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UFO.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwsrv.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360tray.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVStart.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mcconsol.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UFO.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\cross.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\adam.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AgentSvr.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\niu.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kabaload.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVSetup.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\pagefile.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\mmsk.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RsAgent.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvXP.kxp ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\sos.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KvReport.kxp ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwcfg.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AutoRun.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\taskmgr.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\AppSvc32.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\autoruns.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFW.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UIHost.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UpLive.EXE\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FTCleanerShell.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatchX.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\HijackThis.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\XP.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Rav.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavTask.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Trojanwall.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAVDX.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\kvupload.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\UmxAttachment.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KWatch9x.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\PFWLiveUpdate.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Discovery.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\iparmo.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KMFilter.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\runiep.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SmartUp.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\SDGames.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\servet.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32krn.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RegClean.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KAV32.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\loaddll.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\360Safe.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\IceSword.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\nod32kui.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\guangd.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\niu.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\FileDsty.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\KPFW32X.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\RavStub.exe\Debugger = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\rfwProxy.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\scan32.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2891029575-1462575-1165213807-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\dsfghjgj = "C:\\Windows\\system32\\keepSafe.exe" ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe -
Drops file in System32 directory 2 IoCs
description ioc Process File created C:\Windows\SysWOW64\keepSafe.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe File opened for modification C:\Windows\SysWOW64\keepSafe.exe ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
pid Process 2440 ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe 2440 ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: SeDebugPrivilege 2440 ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe -
Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 2440 wrote to memory of 1172 2440 ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe 80 PID 2440 wrote to memory of 1172 2440 ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe 80 PID 2440 wrote to memory of 1172 2440 ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe 80 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\explorer ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe"C:\Users\Admin\AppData\Local\Temp\ebddace66dc2852e3c785dfad2478d2eb306b9c10d3d55fdd90532db0c40d3c0.exe"1⤵
- Adds policy Run key to start application
- Sets file execution options in registry
- Adds Run key to start application
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2440 -
C:\Windows\SysWOW64\Notepad.exeNotepad.exe2⤵PID:1172
-