Analysis
-
max time kernel
30s -
platform
windows10-2004_x64 -
resource
win10v2004-20230703-en -
resource tags
arch:x64arch:x86image:win10v2004-20230703-enlocale:en-usos:windows10-2004-x64system -
submitted
04-07-2023 15:10
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe
Resource
win7-20230703-en
windows7-x64
17 signatures
150 seconds
Behavioral task
behavioral2
Sample
easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
8 signatures
150 seconds
General
-
Target
easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe
-
Size
708KB
-
MD5
782930e73605def9d9068107e9dd6cea
-
SHA1
2a34ae55e1c2f5dfcd016d91195a7ab98dab027d
-
SHA256
240044c40257a31951e78eac380df35c07e2a87cba0373df261b2d6ffa29b4f0
-
SHA512
24fc7e18366070cd615fecd82fd4d6ebe1e20b4e62237da0d3646df9b05517123748e3cfc34f704a210bdf48cc2db957868ac54fa5c346940761d6067cb8618f
-
SSDEEP
12288:wpgvmzFHi0mo5aH0qMzd5807FcmPJQPDHvdq:wpgvOHi0mGaH0qSdPFb4Vq
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell = "Explorer.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe -
Adds policy Run key to start application 2 TTPs 6 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajjrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\njwrgcmkerljxddvne.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nzcnsees = "xrcvickgyjbxjnlb.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajjrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ljyvmkwwshddtbdxrkhf.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\nzcnsees = "njwrgcmkerljxddvne.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\ajjrt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvjfvsdcxlgfubcvogc.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe -
Disables RegEdit via registry modification 2 IoCs
description ioc Process Set value (int) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe -
Adds Run key to start application 2 TTPs 23 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xlqdkyaqch = "njwrgcmkerljxddvne.exe ." easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pfmbkaewkrfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ljyvmkwwshddtbdxrkhf.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\shnbjybsfly = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ezlftoxunzspchgxo.exe ." easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\yjlvzkj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\azpnferspfcdudgbwqond.exe ." easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lvwfis = "xrcvickgyjbxjnlb.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\yjlvzkj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrcvickgyjbxjnlb.exe ." easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\lvwfis = "yvjfvsdcxlgfubcvogc.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ervhnabqb = "azpnferspfcdudgbwqond.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\yjlvzkj = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvjfvsdcxlgfubcvogc.exe ." easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ervhnabqb = "ezlftoxunzspchgxo.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\yjlvzkj = "njwrgcmkerljxddvne.exe ." easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Key created \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\RunOnce\yjlvzkj = "yvjfvsdcxlgfubcvogc.exe ." easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pfmbkaewkrfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\xrcvickgyjbxjnlb.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvwfis = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ljyvmkwwshddtbdxrkhf.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\ervhnabqb = "yvjfvsdcxlgfubcvogc.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\lvwfis = "C:\\Users\\Admin\\AppData\\Local\\Temp\\yvjfvsdcxlgfubcvogc.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xlqdkyaqch = "ljyvmkwwshddtbdxrkhf.exe ." easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\USER\S-1-5-21-1498570331-2313266200-788959944-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\RunOnce\xlqdkyaqch = "azpnferspfcdudgbwqond.exe ." easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\pfmbkaewkrfx = "C:\\Users\\Admin\\AppData\\Local\\Temp\\njwrgcmkerljxddvne.exe" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
System policy modification 1 TTPs 13 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorAdmin = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ConsentPromptBehaviorUser = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\ValidateAdminCodeSignatures = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\FilterAdministratorToken = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\DisableRegistryTools = "1" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableSecureUIAPaths = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableVirtualization = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\PromptOnSecureDesktop = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoDriveTypeAutoRun = "1" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableInstallerDetection = "0" easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe"C:\Users\Admin\AppData\Local\Temp\easy_Malicious_016cf5c636189b8d17e0d7d3e5be94da0ca22dc15f422de4081393feb91abe85.exe"1⤵
- Modifies WinLogon for persistence
- UAC bypass
- Adds policy Run key to start application
- Disables RegEdit via registry modification
- Adds Run key to start application
- Checks whether UAC is enabled
- System policy modification
PID:3904