Analysis
-
max time kernel
88s -
max time network
143s -
platform
windows10-2004_x64 -
resource
win10v2004-20221111-en -
resource tags
arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 12:21
Static task
static1
Behavioral task
behavioral1
Sample
ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe
Resource
win7-20221111-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe
Resource
win10v2004-20221111-en
windows10-2004-x64
7 signatures
150 seconds
General
-
Target
ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe
-
Size
748KB
-
MD5
25379c62de2d13ec20a1a52528bca4d3
-
SHA1
48dce85d061cc727c68548b037e9cb58ff731e82
-
SHA256
ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d
-
SHA512
347b6f39ccf65ae3472d3fd7431c3176e3dd03d80bb30f8556e8097c7c76c537184c8a81dc5e86526f2980470b675302e3f8aab48d05b30fa14e6f3a45b07654
-
SSDEEP
12288:GjcTg+WwJA8qUJqRl7k86fpgBDDJrS7LE9HTFIUYVRSs5K4aOEVh:GjcTDWGRJS7kF6lDJqLGT4RSsk4sVh
Score
8/10
Malware Config
Signatures
-
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe Set value (str) \REGISTRY\USER\S-1-5-21-4246620582-653642754-1174164128-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\MessengerSharing = "C:\\Windows\\system32" ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe -
Drops file in Drivers directory 1 IoCs
description ioc Process File opened for modification C:\Windows\system32\drivers\etc\hosts ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\SysWOW64 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe -
Modifies registry class 5 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB4585A7-D199-2D0E-ED3D-E7430751FDDD}\InprocServer32 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB4585A7-D199-2D0E-ED3D-E7430751FDDD}\InprocServer32\ = "C:\\Windows\\SysWOW64\\PortableDeviceTypes.dll" ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB4585A7-D199-2D0E-ED3D-E7430751FDDD}\InprocServer32\ThreadingModel = "Both" ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB4585A7-D199-2D0E-ED3D-E7430751FDDD} ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{AB4585A7-D199-2D0E-ED3D-E7430751FDDD}\ = "Provides IPortableDevicePropVariantCollection helper methods for portable devices applications and drivers" ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
description pid Process Token: 33 1844 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe Token: SeIncBasePriorityPrivilege 1844 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe Token: 33 1844 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe Token: SeIncBasePriorityPrivilege 1844 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83 PID 1340 wrote to memory of 1844 1340 ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe 83
Processes
-
C:\Users\Admin\AppData\Local\Temp\ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe"C:\Users\Admin\AppData\Local\Temp\ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:1340 -
C:\Users\Admin\AppData\Local\Temp\ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe"C:\Users\Admin\AppData\Local\Temp\ea779514e276f60c11685d2d306a10dfa92da35b8aa1ab2f7c0aa4eaf1c7f43d.exe"2⤵
- Adds policy Run key to start application
- Drops file in Drivers directory
- Checks BIOS information in registry
- Drops file in Windows directory
- Modifies registry class
- Suspicious use of AdjustPrivilegeToken
PID:1844
-