Analysis
-
max time kernel
159s -
max time network
164s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
29-12-2023 18:25
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
00629951d043913541372c919403c1e7.exe
Resource
win7-20231215-en
windows7-x64
5 signatures
150 seconds
Behavioral task
behavioral2
Sample
00629951d043913541372c919403c1e7.exe
Resource
win10v2004-20231215-en
windows10-2004-x64
5 signatures
150 seconds
General
-
Target
00629951d043913541372c919403c1e7.exe
-
Size
448KB
-
MD5
00629951d043913541372c919403c1e7
-
SHA1
985eccddbd42f63bd2bca0bee90fc34507a7f61e
-
SHA256
39b7b640eba9c29b8d45fd1c4c2dcbfc30f7247b090207ec26191f789e507efa
-
SHA512
f6a30f5b6f1f6649f73da73dda5152e28993c8a9a3dda6181e6f765b2f8c0c048ce115c093ff409ebf31df5b3bd839e84555d2b8c598fa74850564aeaa01e07a
-
SSDEEP
6144:8h5IVKmFs4Hb4I2HIEi+nPHawdn0/JRSerTWIdeFjkZM6jI7F1eZ9A3R:45IVKCsC4IsKRFqIQFjkZM6jI7TeZ2
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\bot.exe = "C:\\Users\\Admin\\AppData\\Roaming\\bot.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\00629951d043913541372c919403c1e7.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\00629951d043913541372c919403c1e7.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe -
Modifies registry key 1 TTPs 4 IoCs
pid Process 2084 reg.exe 3240 reg.exe 2220 reg.exe 1292 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 4576 00629951d043913541372c919403c1e7.exe Token: SeCreateTokenPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeAssignPrimaryTokenPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeLockMemoryPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeIncreaseQuotaPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeMachineAccountPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeTcbPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeSecurityPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeTakeOwnershipPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeLoadDriverPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeSystemProfilePrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeSystemtimePrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeProfSingleProcessPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeIncBasePriorityPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeCreatePagefilePrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeCreatePermanentPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeBackupPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeRestorePrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeShutdownPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeDebugPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeAuditPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeSystemEnvironmentPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeChangeNotifyPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeRemoteShutdownPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeUndockPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeSyncAgentPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeEnableDelegationPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeManageVolumePrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeImpersonatePrivilege 4576 00629951d043913541372c919403c1e7.exe Token: SeCreateGlobalPrivilege 4576 00629951d043913541372c919403c1e7.exe Token: 31 4576 00629951d043913541372c919403c1e7.exe Token: 32 4576 00629951d043913541372c919403c1e7.exe Token: 33 4576 00629951d043913541372c919403c1e7.exe Token: 34 4576 00629951d043913541372c919403c1e7.exe Token: 35 4576 00629951d043913541372c919403c1e7.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
pid Process 4576 00629951d043913541372c919403c1e7.exe 4576 00629951d043913541372c919403c1e7.exe 4576 00629951d043913541372c919403c1e7.exe 4576 00629951d043913541372c919403c1e7.exe -
Suspicious use of WriteProcessMemory 24 IoCs
description pid Process procid_target PID 4576 wrote to memory of 2348 4576 00629951d043913541372c919403c1e7.exe 93 PID 4576 wrote to memory of 2348 4576 00629951d043913541372c919403c1e7.exe 93 PID 4576 wrote to memory of 2348 4576 00629951d043913541372c919403c1e7.exe 93 PID 4576 wrote to memory of 2168 4576 00629951d043913541372c919403c1e7.exe 96 PID 4576 wrote to memory of 2168 4576 00629951d043913541372c919403c1e7.exe 96 PID 4576 wrote to memory of 2168 4576 00629951d043913541372c919403c1e7.exe 96 PID 4576 wrote to memory of 3480 4576 00629951d043913541372c919403c1e7.exe 95 PID 4576 wrote to memory of 3480 4576 00629951d043913541372c919403c1e7.exe 95 PID 4576 wrote to memory of 3480 4576 00629951d043913541372c919403c1e7.exe 95 PID 4576 wrote to memory of 412 4576 00629951d043913541372c919403c1e7.exe 94 PID 4576 wrote to memory of 412 4576 00629951d043913541372c919403c1e7.exe 94 PID 4576 wrote to memory of 412 4576 00629951d043913541372c919403c1e7.exe 94 PID 2348 wrote to memory of 2084 2348 cmd.exe 101 PID 2348 wrote to memory of 2084 2348 cmd.exe 101 PID 2348 wrote to memory of 2084 2348 cmd.exe 101 PID 412 wrote to memory of 3240 412 cmd.exe 102 PID 412 wrote to memory of 3240 412 cmd.exe 102 PID 412 wrote to memory of 3240 412 cmd.exe 102 PID 3480 wrote to memory of 2220 3480 cmd.exe 103 PID 3480 wrote to memory of 2220 3480 cmd.exe 103 PID 3480 wrote to memory of 2220 3480 cmd.exe 103 PID 2168 wrote to memory of 1292 2168 cmd.exe 104 PID 2168 wrote to memory of 1292 2168 cmd.exe 104 PID 2168 wrote to memory of 1292 2168 cmd.exe 104
Processes
-
C:\Users\Admin\AppData\Local\Temp\00629951d043913541372c919403c1e7.exe"C:\Users\Admin\AppData\Local\Temp\00629951d043913541372c919403c1e7.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4576 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2348 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2084
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:412 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\bot.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\bot.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:3240
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f2⤵
- Suspicious use of WriteProcessMemory
PID:3480 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:2220
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\00629951d043913541372c919403c1e7.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\00629951d043913541372c919403c1e7.exe:*:Enabled:Windows Messanger" /f2⤵
- Suspicious use of WriteProcessMemory
PID:2168 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\00629951d043913541372c919403c1e7.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\00629951d043913541372c919403c1e7.exe:*:Enabled:Windows Messanger" /f3⤵
- Modifies firewall policy service
- Modifies registry key
PID:1292
-
-