Analysis
-
max time kernel
149s -
max time network
154s -
platform
windows10-2004_x64 -
resource
win10v2004-20231222-en -
resource tags
arch:x64arch:x86image:win10v2004-20231222-enlocale:en-usos:windows10-2004-x64system -
submitted
19-01-2024 16:32
Static task
static1
Behavioral task
behavioral1
Sample
681ac6da809b115402863a99f02122cf.exe
Resource
win7-20231129-en
Behavioral task
behavioral2
Sample
681ac6da809b115402863a99f02122cf.exe
Resource
win10v2004-20231222-en
General
-
Target
681ac6da809b115402863a99f02122cf.exe
-
Size
600KB
-
MD5
681ac6da809b115402863a99f02122cf
-
SHA1
d50d6c617b823a58b042650515d7a1e4c1de61fe
-
SHA256
4937c5ad9b7c054d4aef98230a228555e71addbfdb93f2826156d3872a7f794a
-
SHA512
8de24c09922b73df0a0edb89bbe9464f876eb85491b71693cadc6dda5434f369dd439246208f9a4c069e1d7eb4db9f84d9d33e1309df581aeba4e4b0022fa290
-
SSDEEP
12288:SgskAh0Eqp+p++TAoe2khAOtfTzRioTx1OG:SkAh0Eqp+hASkhAOtfTzRBN1OG
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
Processes:
reg.exereg.exereg.exereg.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\681ac6da809b115402863a99f02122cf.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\681ac6da809b115402863a99f02122cf.exe:*:Enabled:Windows Messanger" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\local.exe = "C:\\Users\\Admin\\AppData\\Roaming\\local.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
681ac6da809b115402863a99f02122cf.exedescription pid process target process PID 2440 set thread context of 3508 2440 681ac6da809b115402863a99f02122cf.exe 681ac6da809b115402863a99f02122cf.exe -
Modifies registry key 1 TTPs 4 IoCs
Processes:
reg.exereg.exereg.exereg.exepid process 4380 reg.exe 2204 reg.exe 3940 reg.exe 4604 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
Processes:
681ac6da809b115402863a99f02122cf.exedescription pid process Token: 1 3508 681ac6da809b115402863a99f02122cf.exe Token: SeCreateTokenPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeAssignPrimaryTokenPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeLockMemoryPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeIncreaseQuotaPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeMachineAccountPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeTcbPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeSecurityPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeTakeOwnershipPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeLoadDriverPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeSystemProfilePrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeSystemtimePrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeProfSingleProcessPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeIncBasePriorityPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeCreatePagefilePrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeCreatePermanentPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeBackupPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeRestorePrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeShutdownPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeDebugPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeAuditPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeSystemEnvironmentPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeChangeNotifyPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeRemoteShutdownPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeUndockPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeSyncAgentPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeEnableDelegationPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeManageVolumePrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeImpersonatePrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: SeCreateGlobalPrivilege 3508 681ac6da809b115402863a99f02122cf.exe Token: 31 3508 681ac6da809b115402863a99f02122cf.exe Token: 32 3508 681ac6da809b115402863a99f02122cf.exe Token: 33 3508 681ac6da809b115402863a99f02122cf.exe Token: 34 3508 681ac6da809b115402863a99f02122cf.exe Token: 35 3508 681ac6da809b115402863a99f02122cf.exe -
Suspicious use of SetWindowsHookEx 4 IoCs
Processes:
681ac6da809b115402863a99f02122cf.exe681ac6da809b115402863a99f02122cf.exepid process 2440 681ac6da809b115402863a99f02122cf.exe 3508 681ac6da809b115402863a99f02122cf.exe 3508 681ac6da809b115402863a99f02122cf.exe 3508 681ac6da809b115402863a99f02122cf.exe -
Suspicious use of WriteProcessMemory 32 IoCs
Processes:
681ac6da809b115402863a99f02122cf.exe681ac6da809b115402863a99f02122cf.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2440 wrote to memory of 3508 2440 681ac6da809b115402863a99f02122cf.exe 681ac6da809b115402863a99f02122cf.exe PID 2440 wrote to memory of 3508 2440 681ac6da809b115402863a99f02122cf.exe 681ac6da809b115402863a99f02122cf.exe PID 2440 wrote to memory of 3508 2440 681ac6da809b115402863a99f02122cf.exe 681ac6da809b115402863a99f02122cf.exe PID 2440 wrote to memory of 3508 2440 681ac6da809b115402863a99f02122cf.exe 681ac6da809b115402863a99f02122cf.exe PID 2440 wrote to memory of 3508 2440 681ac6da809b115402863a99f02122cf.exe 681ac6da809b115402863a99f02122cf.exe PID 2440 wrote to memory of 3508 2440 681ac6da809b115402863a99f02122cf.exe 681ac6da809b115402863a99f02122cf.exe PID 2440 wrote to memory of 3508 2440 681ac6da809b115402863a99f02122cf.exe 681ac6da809b115402863a99f02122cf.exe PID 2440 wrote to memory of 3508 2440 681ac6da809b115402863a99f02122cf.exe 681ac6da809b115402863a99f02122cf.exe PID 3508 wrote to memory of 4400 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 3508 wrote to memory of 4400 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 3508 wrote to memory of 4400 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 3508 wrote to memory of 3792 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 3508 wrote to memory of 3792 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 3508 wrote to memory of 3792 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 3508 wrote to memory of 4972 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 3508 wrote to memory of 4972 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 3508 wrote to memory of 4972 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 3508 wrote to memory of 3976 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 3508 wrote to memory of 3976 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 3508 wrote to memory of 3976 3508 681ac6da809b115402863a99f02122cf.exe cmd.exe PID 4400 wrote to memory of 2204 4400 cmd.exe reg.exe PID 4400 wrote to memory of 2204 4400 cmd.exe reg.exe PID 4400 wrote to memory of 2204 4400 cmd.exe reg.exe PID 3792 wrote to memory of 4380 3792 cmd.exe reg.exe PID 3792 wrote to memory of 4380 3792 cmd.exe reg.exe PID 3792 wrote to memory of 4380 3792 cmd.exe reg.exe PID 4972 wrote to memory of 4604 4972 cmd.exe reg.exe PID 4972 wrote to memory of 4604 4972 cmd.exe reg.exe PID 4972 wrote to memory of 4604 4972 cmd.exe reg.exe PID 3976 wrote to memory of 3940 3976 cmd.exe reg.exe PID 3976 wrote to memory of 3940 3976 cmd.exe reg.exe PID 3976 wrote to memory of 3940 3976 cmd.exe reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\681ac6da809b115402863a99f02122cf.exe"C:\Users\Admin\AppData\Local\Temp\681ac6da809b115402863a99f02122cf.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\681ac6da809b115402863a99f02122cf.exeC:\Users\Admin\AppData\Local\Temp\681ac6da809b115402863a99f02122cf.exe2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\local.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\local.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\681ac6da809b115402863a99f02122cf.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\681ac6da809b115402863a99f02122cf.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\681ac6da809b115402863a99f02122cf.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\681ac6da809b115402863a99f02122cf.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
Network
MITRE ATT&CK Matrix ATT&CK v13
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3508-2-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3508-4-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3508-10-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3508-11-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3508-13-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3508-15-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3508-17-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3508-18-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3508-19-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3508-21-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3508-23-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB
-
memory/3508-26-0x0000000000400000-0x0000000000470000-memory.dmpFilesize
448KB