Analysis
-
max time kernel
149s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20220901-en -
resource tags
arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system -
submitted
05/12/2022, 23:59
Static task
static1
Behavioral task
behavioral1
Sample
ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe
Resource
win10v2004-20220901-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe
-
Size
412KB
-
MD5
043d5cb4d0ca916401d4b80dd5aa47ad
-
SHA1
136d8ff013f1dab53d9be15ab14e03f3be52c413
-
SHA256
ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b
-
SHA512
20695e7b7198bbae654fd53d549b24a90176cc14510d2314e427fdaefb311cad1ed720c29ed921edf955619c5e07a9e9978dfd2121d8d1d8db1ba16888850f55
-
SSDEEP
6144:KE7pMoc0VP7BHng5HaQKMyOiRqIl52TmUuon4ua0vD1+PuRIAOY:KwSsdgaVfR54mUuon4ua0vx+PCQY
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\93BAF6965L.exe = "C:\\Users\\Admin\\AppData\\Roaming\\93BAF6965L.exe:*:Enabled:Windows Messanger" reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\93BAF6965L.exe" ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{8DFAADBA-DDD3-F959-68B8-DB6CDEE7AC13}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\93BAF6965L.exe" ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8DFAADBA-DDD3-F959-68B8-DB6CDEE7AC13} ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{8DFAADBA-DDD3-F959-68B8-DB6CDEE7AC13}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\93BAF6965L.exe" ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{8DFAADBA-DDD3-F959-68B8-DB6CDEE7AC13} ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\93BAF6965L.exe" ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Key created \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Set value (str) \REGISTRY\USER\S-1-5-21-929662420-1054238289-2961194603-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\svchost = "C:\\Users\\Admin\\AppData\\Roaming\\93BAF6965L.exe" ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 220 reg.exe 112 reg.exe 204 reg.exe 1876 reg.exe -
Suspicious use of AdjustPrivilegeToken 36 IoCs
description pid Process Token: 1 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeCreateTokenPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeAssignPrimaryTokenPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeLockMemoryPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeIncreaseQuotaPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeMachineAccountPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeTcbPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeSecurityPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeTakeOwnershipPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeLoadDriverPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeSystemProfilePrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeSystemtimePrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeProfSingleProcessPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeIncBasePriorityPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeCreatePagefilePrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeCreatePermanentPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeBackupPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeRestorePrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeShutdownPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeDebugPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeAuditPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeSystemEnvironmentPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeChangeNotifyPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeRemoteShutdownPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeUndockPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeSyncAgentPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeEnableDelegationPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeManageVolumePrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeImpersonatePrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeCreateGlobalPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: 31 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: 32 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: 33 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: 34 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: 35 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe Token: SeDebugPrivilege 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 3256 wrote to memory of 1856 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 82 PID 3256 wrote to memory of 1856 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 82 PID 3256 wrote to memory of 1856 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 82 PID 3256 wrote to memory of 2428 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 83 PID 3256 wrote to memory of 2428 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 83 PID 3256 wrote to memory of 2428 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 83 PID 3256 wrote to memory of 2056 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 84 PID 3256 wrote to memory of 2056 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 84 PID 3256 wrote to memory of 2056 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 84 PID 3256 wrote to memory of 552 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 85 PID 3256 wrote to memory of 552 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 85 PID 3256 wrote to memory of 552 3256 ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe 85 PID 552 wrote to memory of 204 552 cmd.exe 92 PID 552 wrote to memory of 204 552 cmd.exe 92 PID 552 wrote to memory of 204 552 cmd.exe 92 PID 2056 wrote to memory of 112 2056 cmd.exe 91 PID 2056 wrote to memory of 112 2056 cmd.exe 91 PID 2056 wrote to memory of 112 2056 cmd.exe 91 PID 1856 wrote to memory of 220 1856 cmd.exe 90 PID 1856 wrote to memory of 220 1856 cmd.exe 90 PID 1856 wrote to memory of 220 1856 cmd.exe 90 PID 2428 wrote to memory of 1876 2428 cmd.exe 93 PID 2428 wrote to memory of 1876 2428 cmd.exe 93 PID 2428 wrote to memory of 1876 2428 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe"C:\Users\Admin\AppData\Local\Temp\ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3256 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1856 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:220
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2428 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ad31c4576c14ebfd993b360e1bb8994ca16b46bcf675c0dac5156c4d405b2a2b.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1876
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2056 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:112
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\93BAF6965L.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\93BAF6965L.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\93BAF6965L.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\93BAF6965L.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:204
-
-