Analysis
-
max time kernel
153s -
max time network
180s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 00:06
Static task
static1
Behavioral task
behavioral1
Sample
af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe
Resource
win7-20221111-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe
-
Size
420KB
-
MD5
9e928e69013d1fbe59b37549fae7c277
-
SHA1
0f584aa88906f2628d9365d24953d10500b4c099
-
SHA256
af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2
-
SHA512
aa8149b018e2fe1ae97c9e978861f1c7f32030b410d50dbca107dcd9b973684b10ca0352c6c7b89248a8b7d46692320e38990f107f7790ae79d8c42db01cb55f
-
SSDEEP
6144:2IVUqq3PBHng5HavbEd6FxuDC8zVpJ46U/uRqy1gP:2ImJgazdUCaVpJ46U/uRqyM
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Explorer.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Explorer.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Explorer = "C:\\Users\\Admin\\AppData\\Roaming\\Explorer.exe" af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EECFDBB-E9FC-AFF9-AA9F-BCA4CBCAFE06} af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{6EECFDBB-E9FC-AFF9-AA9F-BCA4CBCAFE06}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Explorer.exe" af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{6EECFDBB-E9FC-AFF9-AA9F-BCA4CBCAFE06} af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{6EECFDBB-E9FC-AFF9-AA9F-BCA4CBCAFE06}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Explorer.exe" af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Explorer = "C:\\Users\\Admin\\AppData\\Roaming\\Explorer.exe" af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Explorer = "C:\\Users\\Admin\\AppData\\Roaming\\Explorer.exe" af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Key created \REGISTRY\USER\S-1-5-21-2629973501-4017243118-3254762364-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 3496 reg.exe 3776 reg.exe 856 reg.exe 2612 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeCreateTokenPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeAssignPrimaryTokenPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeLockMemoryPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeIncreaseQuotaPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeMachineAccountPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeTcbPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeSecurityPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeTakeOwnershipPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeLoadDriverPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeSystemProfilePrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeSystemtimePrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeProfSingleProcessPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeIncBasePriorityPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeCreatePagefilePrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeCreatePermanentPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeBackupPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeRestorePrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeShutdownPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeDebugPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeAuditPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeSystemEnvironmentPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeChangeNotifyPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeRemoteShutdownPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeUndockPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeSyncAgentPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeEnableDelegationPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeManageVolumePrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeImpersonatePrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: SeCreateGlobalPrivilege 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: 31 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: 32 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: 33 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: 34 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe Token: 35 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 1408 wrote to memory of 532 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 83 PID 1408 wrote to memory of 532 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 83 PID 1408 wrote to memory of 532 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 83 PID 1408 wrote to memory of 1292 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 84 PID 1408 wrote to memory of 1292 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 84 PID 1408 wrote to memory of 1292 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 84 PID 1408 wrote to memory of 4436 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 88 PID 1408 wrote to memory of 4436 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 88 PID 1408 wrote to memory of 4436 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 88 PID 1408 wrote to memory of 3876 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 87 PID 1408 wrote to memory of 3876 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 87 PID 1408 wrote to memory of 3876 1408 af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe 87 PID 1292 wrote to memory of 2612 1292 cmd.exe 92 PID 1292 wrote to memory of 2612 1292 cmd.exe 92 PID 1292 wrote to memory of 2612 1292 cmd.exe 92 PID 532 wrote to memory of 3776 532 cmd.exe 94 PID 532 wrote to memory of 3776 532 cmd.exe 94 PID 532 wrote to memory of 3776 532 cmd.exe 94 PID 3876 wrote to memory of 856 3876 cmd.exe 91 PID 3876 wrote to memory of 856 3876 cmd.exe 91 PID 3876 wrote to memory of 856 3876 cmd.exe 91 PID 4436 wrote to memory of 3496 4436 cmd.exe 93 PID 4436 wrote to memory of 3496 4436 cmd.exe 93 PID 4436 wrote to memory of 3496 4436 cmd.exe 93
Processes
-
C:\Users\Admin\AppData\Local\Temp\af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe"C:\Users\Admin\AppData\Local\Temp\af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe"1⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:1408 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:532 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3776
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:1292 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\af34cee2d527fe77f6dce09a3bf6ae76bb7a3eab1136bd158f38fa694cf397a2.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2612
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Explorer.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3876 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Explorer.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Explorer.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:856
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:4436 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3496
-
-