Analysis
- max time kernel
150s - max time network
149s - platform
windows10-2004_x64 - resource
win10v2004-20231130-en - resource tags
arch:x64arch:x86image:win10v2004-20231130-enlocale:en-usos:windows10-2004-x64system - submitted
14/12/2023, 00:31
Behavioral task
behavioral1
Sample
2b6bd5292104e28b04d04d90ad3bfeac.exe
Resource
win7-20231020-en
windows7-x64
7 signatures
150 seconds
Behavioral task
behavioral2
Sample
2b6bd5292104e28b04d04d90ad3bfeac.exe
Resource
win10v2004-20231130-en
windows10-2004-x64
7 signatures
150 seconds
General
- Target 2b6bd5292104e28b04d04d90ad3bfeac.exe
- Size 31KB
- Sample231214-at2tmsachp
- SHA256 f2fce7a94739dc81a39adcae9773b0a76c8d45986b26f51ccabd14285aaa8b64
- MD5 2b6bd5292104e28b04d04d90ad3bfeac
- SHA1 211502d4fb7fd341848db8f61b0d87fc79284184
- SHA512 dc301a274e9ffc20d6334c300341eed223575a786dd4784f11c967c72b6eaeeea16e6489cc4c3bd974ac71efa19460e86370a62f9df217256ba8989617b67a41
- SSDEEP 768:jZB4IZBDTuzxZ+KKczDNpHvhR/QmIDUu0tiS9j:Yc6lhjQVkLj
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Signatures
- Modifies Windows Firewall 1 TTPs 1 IoCs
pid Process 4424 netsh.exe - Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4b02323a558ac1bf51f8596d10e96d94.exe 2b6bd5292104e28b04d04d90ad3bfeac.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\4b02323a558ac1bf51f8596d10e96d94.exe 2b6bd5292104e28b04d04d90ad3bfeac.exe - Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-596315103-1488671723-776734015-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\4b02323a558ac1bf51f8596d10e96d94 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2b6bd5292104e28b04d04d90ad3bfeac.exe\" .." 2b6bd5292104e28b04d04d90ad3bfeac.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\4b02323a558ac1bf51f8596d10e96d94 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\2b6bd5292104e28b04d04d90ad3bfeac.exe\" .." 2b6bd5292104e28b04d04d90ad3bfeac.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe - Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: SeDebugPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: 33 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe Token: SeIncBasePriorityPrivilege 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe - Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3176 wrote to memory of 4424 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 99 PID 3176 wrote to memory of 4424 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 99 PID 3176 wrote to memory of 4424 3176 2b6bd5292104e28b04d04d90ad3bfeac.exe 99
Processes
-
C:\Users\Admin\AppData\Local\Temp\2b6bd5292104e28b04d04d90ad3bfeac.exe"C:\Users\Admin\AppData\Local\Temp\2b6bd5292104e28b04d04d90ad3bfeac.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3176 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\2b6bd5292104e28b04d04d90ad3bfeac.exe" "2b6bd5292104e28b04d04d90ad3bfeac.exe" ENABLE2⤵
- Modifies Windows Firewall
PID:4424
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1