Resubmissions
27-08-2023 15:40
230827-s3887aba84 1027-08-2023 15:39
230827-s35k1acg91 1027-08-2023 15:39
230827-s3w9macg9x 1027-08-2023 12:17
230827-pf6b8shd87 1027-08-2023 12:17
230827-pf3akshd86 1027-08-2023 12:16
230827-pfzvfshd85 1027-08-2023 12:16
230827-pfsfdabc8w 1027-08-2023 12:16
230827-pflylahd84 1027-08-2023 12:16
230827-pfgc4sbc8v 1027-08-2023 12:15
230827-pfc1pahd83 10Analysis
-
max time kernel
1800s -
max time network
1795s -
platform
windows7_x64 -
resource
win7-20230712-en -
resource tags
arch:x64arch:x86image:win7-20230712-enlocale:en-usos:windows7-x64system -
submitted
27-08-2023 12:16
Behavioral task
behavioral1
Sample
ExcenSC.exe
Resource
win7-20230712-en
windows7-x64
7 signatures
1800 seconds
Behavioral task
behavioral2
Sample
ExcenSC.exe
Resource
win10-20230703-en
windows10-1703-x64
7 signatures
1800 seconds
Behavioral task
behavioral3
Sample
ExcenSC.exe
Resource
win10v2004-20230703-en
windows10-2004-x64
7 signatures
1800 seconds
General
-
Target
ExcenSC.exe
-
Size
93KB
-
MD5
caa7446c3e832a53be9336da30627217
-
SHA1
fd6476edb0eada6f521ff9f22b58ea9ae5e1e957
-
SHA256
35088ea25301db3dab3752a3ab02332083339080a3f8c8fd253b70607492aa26
-
SHA512
330724395111ff77e43b172f62a30f22c7305125924d1ca9ac0977ad622794075ae5f07fc494ebb01ce886597436332d35dac711a7f3d228b47fe111da92f3d7
-
SSDEEP
768:cY3yGL30YTXspgM0m2zGjpyDtdXWuxtXYLWhyXxrjEtCdnl2pi1Rz4Rk3ysGdpq3:eGD0AA0mT1mrWxL5jEwzGi1dDODqgS
Score
8/10
Malware Config
Signatures
-
Modifies Windows Firewall 1 TTPs 3 IoCs
pid Process 2900 netsh.exe 2668 netsh.exe 2872 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe ExcenSC.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Microsoft Corporation.exe ExcenSC.exe -
Drops autorun.inf file 1 TTPs 4 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf ExcenSC.exe File opened for modification C:\autorun.inf ExcenSC.exe File created F:\autorun.inf ExcenSC.exe File opened for modification F:\autorun.inf ExcenSC.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe 2888 ExcenSC.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2888 ExcenSC.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: SeDebugPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe Token: SeIncBasePriorityPrivilege 2888 ExcenSC.exe Token: 33 2888 ExcenSC.exe -
Suspicious use of WriteProcessMemory 12 IoCs
description pid Process procid_target PID 2888 wrote to memory of 2900 2888 ExcenSC.exe 28 PID 2888 wrote to memory of 2900 2888 ExcenSC.exe 28 PID 2888 wrote to memory of 2900 2888 ExcenSC.exe 28 PID 2888 wrote to memory of 2900 2888 ExcenSC.exe 28 PID 2888 wrote to memory of 2668 2888 ExcenSC.exe 30 PID 2888 wrote to memory of 2668 2888 ExcenSC.exe 30 PID 2888 wrote to memory of 2668 2888 ExcenSC.exe 30 PID 2888 wrote to memory of 2668 2888 ExcenSC.exe 30 PID 2888 wrote to memory of 2872 2888 ExcenSC.exe 31 PID 2888 wrote to memory of 2872 2888 ExcenSC.exe 31 PID 2888 wrote to memory of 2872 2888 ExcenSC.exe 31 PID 2888 wrote to memory of 2872 2888 ExcenSC.exe 31
Processes
-
C:\Users\Admin\AppData\Local\Temp\ExcenSC.exe"C:\Users\Admin\AppData\Local\Temp\ExcenSC.exe"1⤵
- Drops startup file
- Drops autorun.inf file
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:2888 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\ExcenSC.exe" "ExcenSC.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:2900
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\ExcenSC.exe"2⤵
- Modifies Windows Firewall
PID:2668
-
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\ExcenSC.exe" "ExcenSC.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:2872
-
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
93KB
MD5caa7446c3e832a53be9336da30627217
SHA1fd6476edb0eada6f521ff9f22b58ea9ae5e1e957
SHA25635088ea25301db3dab3752a3ab02332083339080a3f8c8fd253b70607492aa26
SHA512330724395111ff77e43b172f62a30f22c7305125924d1ca9ac0977ad622794075ae5f07fc494ebb01ce886597436332d35dac711a7f3d228b47fe111da92f3d7