Analysis
-
max time kernel
31s -
max time network
34s -
platform
windows10-2004_x64 -
resource
win10v2004-20230221-en -
resource tags
arch:x64arch:x86image:win10v2004-20230221-enlocale:en-usos:windows10-2004-x64system -
submitted
11/04/2023, 16:40
Static task
static1
Behavioral task
behavioral1
Sample
senex_woofer.exe
Resource
win7-20230220-en
windows7-x64
7 signatures
30 seconds
Behavioral task
behavioral2
Sample
senex_woofer.exe
Resource
win10v2004-20230221-en
windows10-2004-x64
7 signatures
30 seconds
General
-
Target
senex_woofer.exe
-
Size
634KB
-
MD5
911471910c3f25d2880865ec9d26f079
-
SHA1
e24178f42a17e3a9746a039ab69ee3530481adc2
-
SHA256
903c5f1a1f349335849499426f18f75d7fad5b3484a4c74deac26b15248c0693
-
SHA512
0883443da7df2b3ee813bd6858db41c3fd60fb3a6551bafaf3984b2af2b6dff1fcf9719add0b5cb717e7b3cd46e1e0688cca22bf46daaa72a34a9a9ca06445ad
-
SSDEEP
12288:IqLMS0TFtT8n77rodRfyyufQCLbvTBErz+Ry9V:IqLMS0TFtT8kdRIfpbvT2rhH
Score
6/10
Malware Config
Signatures
-
Legitimate hosting services abused for malware hosting/C2 1 TTPs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
pid Process 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe -
Drops file in Windows directory 1 IoCs
description ioc Process File created C:\Windows\senexspooferlogin.txt senex_woofer.exe -
Modifies registry class 9 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-1084115737125322862\ = "URL:Run game 1084115737125322862 protocol" senex_woofer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-1084115737125322862\URL Protocol senex_woofer.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-1084115737125322862\DefaultIcon senex_woofer.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-1084115737125322862\shell\open\command senex_woofer.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-1084115737125322862\shell senex_woofer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-1084115737125322862\shell\open\command\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\senex_woofer.exe" senex_woofer.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-1084115737125322862 senex_woofer.exe Set value (str) \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-1084115737125322862\DefaultIcon\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\senex_woofer.exe" senex_woofer.exe Key created \REGISTRY\USER\S-1-5-21-2805025096-2326403612-4231045514-1000_Classes\discord-1084115737125322862\shell\open senex_woofer.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe 4184 senex_woofer.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
pid Process 4184 senex_woofer.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 4184 wrote to memory of 532 4184 senex_woofer.exe 86 PID 4184 wrote to memory of 532 4184 senex_woofer.exe 86 PID 4184 wrote to memory of 1244 4184 senex_woofer.exe 94 PID 4184 wrote to memory of 1244 4184 senex_woofer.exe 94 PID 4184 wrote to memory of 1788 4184 senex_woofer.exe 95 PID 4184 wrote to memory of 1788 4184 senex_woofer.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\senex_woofer.exe"C:\Users\Admin\AppData\Local\Temp\senex_woofer.exe"1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Windows directory
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:4184 -
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c color 12⤵PID:532
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1244
-
-
C:\Windows\system32\cmd.exeC:\Windows\system32\cmd.exe /c cls2⤵PID:1788
-