Analysis
-
max time kernel
133s -
max time network
45s -
platform
windows7_x64 -
resource
win7-20220812-en -
resource tags
arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system -
submitted
05-12-2022 05:46
Static task
static1
Behavioral task
behavioral1
Sample
a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe
Resource
win7-20220812-en
Behavioral task
behavioral2
Sample
a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe
Resource
win10v2004-20220901-en
General
-
Target
a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe
-
Size
420KB
-
MD5
71ac5addc013828b91359648f0133f51
-
SHA1
0a563f6be753362b770b2eacb375f1541d3df4a3
-
SHA256
a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834
-
SHA512
230c7a9dd1de077de076b26416f18b58ebbebb70328ef5e30796a99abec0e972079fbf9cf7d18e1e6f7b86bf352f810bac881cc5a7c9e52cc143aebe43b01645
-
SSDEEP
6144:k+gEEY+LJHi8zKRKfdlO4s4jF9GZpMtGOkq84BVMZ:kaEYOJHi0KRKw4jFAZdhq84BVM
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe:*:Enabled:@xpsp2res.dll,-22019" a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 892 set thread context of 9324 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 28 PID 9324 set thread context of 10188 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 29 -
Suspicious behavior: EnumeratesProcesses 46 IoCs
pid Process 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe -
Suspicious use of WriteProcessMemory 17 IoCs
description pid Process procid_target PID 892 wrote to memory of 9324 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 28 PID 892 wrote to memory of 9324 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 28 PID 892 wrote to memory of 9324 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 28 PID 892 wrote to memory of 9324 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 28 PID 892 wrote to memory of 9324 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 28 PID 892 wrote to memory of 9324 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 28 PID 892 wrote to memory of 9324 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 28 PID 892 wrote to memory of 9324 892 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 28 PID 9324 wrote to memory of 10188 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 29 PID 9324 wrote to memory of 10188 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 29 PID 9324 wrote to memory of 10188 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 29 PID 9324 wrote to memory of 10188 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 29 PID 9324 wrote to memory of 10188 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 29 PID 9324 wrote to memory of 10188 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 29 PID 9324 wrote to memory of 10188 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 29 PID 9324 wrote to memory of 10188 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 29 PID 9324 wrote to memory of 10188 9324 a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe 29
Processes
-
C:\Users\Admin\AppData\Local\Temp\a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe"C:\Users\Admin\AppData\Local\Temp\a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:892 -
C:\Users\Admin\AppData\Local\Temp\a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exeC:\Users\Admin\AppData\Local\Temp\a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe2⤵
- Modifies firewall policy service
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:9324 -
C:\Users\Admin\AppData\Local\Temp\a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exeC:\Users\Admin\AppData\Local\Temp\a2fdb15acbdd8c3c7489173437839d15a364a30026cfdb1f2c75a92e782f0834.exe -f3⤵PID:10188
-
-