Analysis
-
max time kernel
105s -
max time network
122s -
platform
windows10-2004_x64 -
resource
win10v2004-20220812-en -
resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system -
submitted
11-02-2023 09:21
Static task
static1
Behavioral task
behavioral1
Sample
winserv.exe
Resource
win7-20221111-en
windows7-x64
5 signatures
150 seconds
General
-
Target
winserv.exe
-
Size
10.2MB
-
MD5
3f4f5a6cb95047fea6102bd7d2226aa9
-
SHA1
fc09dd898b6e7ff546e4a7517a715928fbafc297
-
SHA256
99fd9e75e6241eff30e01c5b59df9e901fb24d12bee89c069cc6158f78b3cc98
-
SHA512
de5c8155f426a4e55953ae85410c7d9ad84f5643c30865fc036d1270310e28754772bd0f3093444a16ef0c1fa3db6c56301746fb5e7f03ce692bfdad0c4fb688
-
SSDEEP
196608:iz+UZcWP4jBrfWgEgIV8Rzy7Vj4FZvEo:i6UZcWWeVj4FZ
Malware Config
Signatures
-
Suspicious use of NtCreateUserProcessOtherParentProcess 1 IoCs
Processes:
svchost.exedescription pid process target process PID 5096 created 4752 5096 svchost.exe winserv.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
Processes:
winserv.exedescription ioc process Key value queried \REGISTRY\USER\S-1-5-21-2295526160-1155304984-640977766-1000\Control Panel\International\Geo\Nation winserv.exe -
Suspicious behavior: EnumeratesProcesses 10 IoCs
Processes:
winserv.exewinserv.exepid process 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 5072 winserv.exe 5072 winserv.exe 5072 winserv.exe 5072 winserv.exe -
Suspicious use of AdjustPrivilegeToken 6 IoCs
Processes:
winserv.exesvchost.exewinserv.exedescription pid process Token: SeDebugPrivilege 4752 winserv.exe Token: SeTcbPrivilege 5096 svchost.exe Token: SeTcbPrivilege 5096 svchost.exe Token: SeTakeOwnershipPrivilege 5072 winserv.exe Token: SeTcbPrivilege 5072 winserv.exe Token: SeTcbPrivilege 5072 winserv.exe -
Suspicious use of SetWindowsHookEx 8 IoCs
Processes:
winserv.exewinserv.exepid process 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 4752 winserv.exe 5072 winserv.exe 5072 winserv.exe 5072 winserv.exe 5072 winserv.exe -
Suspicious use of WriteProcessMemory 3 IoCs
Processes:
svchost.exedescription pid process target process PID 5096 wrote to memory of 5072 5096 svchost.exe winserv.exe PID 5096 wrote to memory of 5072 5096 svchost.exe winserv.exe PID 5096 wrote to memory of 5072 5096 svchost.exe winserv.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\winserv.exe"C:\Users\Admin\AppData\Local\Temp\winserv.exe"1⤵
- Checks computer location settings
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Users\Admin\AppData\Local\Temp\winserv.exeC:\Users\Admin\AppData\Local\Temp\winserv.exe -second2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k netsvcs -p -s seclogon1⤵
- Suspicious use of NtCreateUserProcessOtherParentProcess
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/4752-132-0x0000000000400000-0x0000000000E31000-memory.dmpFilesize
10.2MB
-
memory/4752-134-0x0000000000400000-0x0000000000E31000-memory.dmpFilesize
10.2MB
-
memory/5072-133-0x0000000000000000-mapping.dmp
-
memory/5072-135-0x0000000000400000-0x0000000000E31000-memory.dmpFilesize
10.2MB
-
memory/5072-136-0x0000000000400000-0x0000000000E31000-memory.dmpFilesize
10.2MB