Analysis
-
max time kernel
144s -
max time network
152s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
26/12/2023, 14:34
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
75ef4ade1c5277c65763d23dc9ab46dc.exe
Resource
win7-20231215-en
windows7-x64
8 signatures
150 seconds
Behavioral task
behavioral2
Sample
75ef4ade1c5277c65763d23dc9ab46dc.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
10 signatures
150 seconds
General
-
Target
75ef4ade1c5277c65763d23dc9ab46dc.exe
-
Size
80KB
-
MD5
75ef4ade1c5277c65763d23dc9ab46dc
-
SHA1
f943d642ea3a1b972bcc594350ce9553f32ea097
-
SHA256
5c7821de172e5313df15062609f3170ef3872810bcd7d61256b0dd870a4b2db2
-
SHA512
3c0c429fdea45a07dd9fe484f7374892c4624c30956741111399b339cafce4b2c75e18f223809e8827579cd34f7269787ac2e100750c5daa45033c8edd80f364
-
SSDEEP
768:a5j7oznv4IC7Pni73G3dK2jHcQSb52vgURxkZ:WjcznvDj7WM2jFSwbG
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List 75ef4ade1c5277c65763d23dc9ab46dc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile 75ef4ade1c5277c65763d23dc9ab46dc.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications 75ef4ade1c5277c65763d23dc9ab46dc.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\Microsoft-Driver-1-82-8475-5627-5645\winrsvn.exe = "C:\\Users\\Admin\\Microsoft-Driver-1-82-8475-5627-5645\\winrsvn.exe:*:Enabled:Microsoft(R) Update Service" 75ef4ade1c5277c65763d23dc9ab46dc.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\Control Panel\International\Geo\Nation 75ef4ade1c5277c65763d23dc9ab46dc.exe -
Executes dropped EXE 1 IoCs
pid Process 1020 winrsvn.exe -
Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2398549320-3657759451-817663969-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Microsoft(R) Update Service = "C:\\Users\\Admin\\Microsoft-Driver-1-82-8475-5627-5645\\winrsvn.exe" 75ef4ade1c5277c65763d23dc9ab46dc.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 3676 set thread context of 1516 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe 90 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 1 IoCs
pid pid_target Process procid_target 64 1020 WerFault.exe 93 -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Classes\WOW6432Node\CLSID\{1f3427c8-5c10-4210-aa03-2ee45287d668}\Instance\ 75ef4ade1c5277c65763d23dc9ab46dc.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
description pid Process Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: 33 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe Token: SeIncBasePriorityPrivilege 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe -
Suspicious use of WriteProcessMemory 16 IoCs
description pid Process procid_target PID 3676 wrote to memory of 1516 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe 90 PID 3676 wrote to memory of 1516 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe 90 PID 3676 wrote to memory of 1516 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe 90 PID 3676 wrote to memory of 1516 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe 90 PID 3676 wrote to memory of 1516 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe 90 PID 3676 wrote to memory of 1516 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe 90 PID 3676 wrote to memory of 1516 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe 90 PID 3676 wrote to memory of 1516 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe 90 PID 3676 wrote to memory of 1516 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe 90 PID 3676 wrote to memory of 1516 3676 75ef4ade1c5277c65763d23dc9ab46dc.exe 90 PID 1516 wrote to memory of 1020 1516 75ef4ade1c5277c65763d23dc9ab46dc.exe 93 PID 1516 wrote to memory of 1020 1516 75ef4ade1c5277c65763d23dc9ab46dc.exe 93 PID 1516 wrote to memory of 1020 1516 75ef4ade1c5277c65763d23dc9ab46dc.exe 93 PID 1020 wrote to memory of 1828 1020 winrsvn.exe 95 PID 1020 wrote to memory of 1828 1020 winrsvn.exe 95 PID 1020 wrote to memory of 1828 1020 winrsvn.exe 95
Processes
-
C:\Users\Admin\AppData\Local\Temp\75ef4ade1c5277c65763d23dc9ab46dc.exe"C:\Users\Admin\AppData\Local\Temp\75ef4ade1c5277c65763d23dc9ab46dc.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:3676 -
C:\Users\Admin\AppData\Local\Temp\75ef4ade1c5277c65763d23dc9ab46dc.exeC:\Users\Admin\AppData\Local\Temp\75ef4ade1c5277c65763d23dc9ab46dc.exe2⤵
- Modifies firewall policy service
- Checks computer location settings
- Adds Run key to start application
- Modifies registry class
- Suspicious use of WriteProcessMemory
PID:1516 -
C:\Users\Admin\Microsoft-Driver-1-82-8475-5627-5645\winrsvn.exe"C:\Users\Admin\Microsoft-Driver-1-82-8475-5627-5645\winrsvn.exe"3⤵
- Executes dropped EXE
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Users\Admin\Microsoft-Driver-1-82-8475-5627-5645\winrsvn.exeC:\Users\Admin\Microsoft-Driver-1-82-8475-5627-5645\winrsvn.exe4⤵PID:1828
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 1020 -s 3044⤵
- Program crash
PID:64
-
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 1020 -ip 10201⤵PID:3240
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
80KB
MD575ef4ade1c5277c65763d23dc9ab46dc
SHA1f943d642ea3a1b972bcc594350ce9553f32ea097
SHA2565c7821de172e5313df15062609f3170ef3872810bcd7d61256b0dd870a4b2db2
SHA5123c0c429fdea45a07dd9fe484f7374892c4624c30956741111399b339cafce4b2c75e18f223809e8827579cd34f7269787ac2e100750c5daa45033c8edd80f364