Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
06-12-2022 12:30
Static task
static1
Behavioral task
behavioral1
Sample
ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe
Resource
win7-20220812-en
windows7-x64
10 signatures
150 seconds
Behavioral task
behavioral2
Sample
ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe
-
Size
232KB
-
MD5
4f52bab5ba1dfb8ec887857477414872
-
SHA1
c000344ced1890623e3f92188b1193c5a0186916
-
SHA256
ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3
-
SHA512
fb58738e4d15f188908199887c0e46d1df48f1bdbaafdbe5ba5a70b7ae236be7478e26170ec77113a8c77ede45cff1e3688ddb6aadd7d4cdfc2c77d6574f446c
-
SSDEEP
3072:o+N3THZJXEMSPlFep7fe18ryr2t4bZK9+4NpMhqhIyn9/ZJC:oAFV0lH12CbZq+urhIY9h
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\Definition.exe = "C:\\Users\\Admin\\AppData\\Roaming\\Definition.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Definition.exe" ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB5BADFC-DADE-AF3D-B0DE-DAA1BBB0B9BD} ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{AB5BADFC-DADE-AF3D-B0DE-DAA1BBB0B9BD}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Definition.exe" ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{AB5BADFC-DADE-AF3D-B0DE-DAA1BBB0B9BD} ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{AB5BADFC-DADE-AF3D-B0DE-DAA1BBB0B9BD}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\Definition.exe" ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe -
resource yara_rule behavioral2/memory/4120-138-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4120-140-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4120-141-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4120-145-0x0000000000400000-0x000000000045D000-memory.dmp upx behavioral2/memory/4120-146-0x0000000000400000-0x000000000045D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Definition.exe" ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Key created \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Set value (str) \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Defender = "C:\\Users\\Admin\\AppData\\Roaming\\Definition.exe" ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 984 set thread context of 4120 984 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 81 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 1080 reg.exe 3560 reg.exe 2076 reg.exe 1648 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeCreateTokenPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeAssignPrimaryTokenPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeLockMemoryPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeIncreaseQuotaPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeMachineAccountPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeTcbPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeSecurityPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeTakeOwnershipPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeLoadDriverPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeSystemProfilePrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeSystemtimePrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeProfSingleProcessPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeIncBasePriorityPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeCreatePagefilePrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeCreatePermanentPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeBackupPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeRestorePrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeShutdownPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeDebugPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeAuditPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeSystemEnvironmentPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeChangeNotifyPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeRemoteShutdownPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeUndockPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeSyncAgentPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeEnableDelegationPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeManageVolumePrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeImpersonatePrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: SeCreateGlobalPrivilege 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: 31 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: 32 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: 33 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: 34 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe Token: 35 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 984 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe -
Suspicious use of WriteProcessMemory 32 IoCs
description pid Process procid_target PID 984 wrote to memory of 4120 984 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 81 PID 984 wrote to memory of 4120 984 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 81 PID 984 wrote to memory of 4120 984 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 81 PID 984 wrote to memory of 4120 984 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 81 PID 984 wrote to memory of 4120 984 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 81 PID 984 wrote to memory of 4120 984 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 81 PID 984 wrote to memory of 4120 984 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 81 PID 984 wrote to memory of 4120 984 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 81 PID 4120 wrote to memory of 4644 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 83 PID 4120 wrote to memory of 4644 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 83 PID 4120 wrote to memory of 4644 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 83 PID 4120 wrote to memory of 4492 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 84 PID 4120 wrote to memory of 4492 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 84 PID 4120 wrote to memory of 4492 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 84 PID 4120 wrote to memory of 4084 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 89 PID 4120 wrote to memory of 4084 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 89 PID 4120 wrote to memory of 4084 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 89 PID 4120 wrote to memory of 1792 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 88 PID 4120 wrote to memory of 1792 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 88 PID 4120 wrote to memory of 1792 4120 ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe 88 PID 4084 wrote to memory of 1080 4084 cmd.exe 91 PID 4084 wrote to memory of 1080 4084 cmd.exe 91 PID 4084 wrote to memory of 1080 4084 cmd.exe 91 PID 4492 wrote to memory of 3560 4492 cmd.exe 92 PID 4492 wrote to memory of 3560 4492 cmd.exe 92 PID 4492 wrote to memory of 3560 4492 cmd.exe 92 PID 1792 wrote to memory of 2076 1792 cmd.exe 94 PID 1792 wrote to memory of 2076 1792 cmd.exe 94 PID 1792 wrote to memory of 2076 1792 cmd.exe 94 PID 4644 wrote to memory of 1648 4644 cmd.exe 95 PID 4644 wrote to memory of 1648 4644 cmd.exe 95 PID 4644 wrote to memory of 1648 4644 cmd.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe"C:\Users\Admin\AppData\Local\Temp\ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:984 -
C:\Users\Admin\AppData\Local\Temp\ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exeC:\Users\Admin\AppData\Local\Temp\ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4120 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4644 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1648
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4492 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ff31fad271a7485ff537a05c8dc8bd043297847642e2b87013a5ef67880c68a3.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:3560
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Definition.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Definition.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:1792 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\Definition.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\Definition.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:2076
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4084 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1080
-
-
-