Analysis
-
max time kernel
137s -
max time network
145s -
platform
windows10-2004_x64 -
resource
win10v2004-20231215-en -
resource tags
arch:x64arch:x86image:win10v2004-20231215-enlocale:en-usos:windows10-2004-x64system -
submitted
04-02-2024 16:44
Static task
static1
Behavioral task
behavioral1
Sample
8fa716e6d698cff761a257134fc0dcbc.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
8fa716e6d698cff761a257134fc0dcbc.exe
Resource
win10v2004-20231215-en
General
-
Target
8fa716e6d698cff761a257134fc0dcbc.exe
-
Size
244KB
-
MD5
8fa716e6d698cff761a257134fc0dcbc
-
SHA1
1cbb32439e7024126f00f371ebddd81ec850110c
-
SHA256
aa08fb940347c2e06c546e101a2628f13d1f26676b81f97a038296e620fd0e02
-
SHA512
524639d57e7c16d5a45d316fb540e6e0be8fdea137b53e9f2b58fa02883ed45175efb3d9d6ce722ecfc814656c9cf88418212c516e30e5c4077f5835935e4e63
-
SSDEEP
6144:dqz/fSW9BPwtfHImpvlhsvMRpSS8chIQQzsDU:ltf9U8vIQvDU
Malware Config
Signatures
-
Looks up external IP address via web service 3 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
Processes:
flow ioc 20 cmyip.com 9 cmyip.com 11 cmyip.com -
Drops file in System32 directory 2 IoCs
Processes:
8fa716e6d698cff761a257134fc0dcbc.exedescription ioc process File opened for modification C:\Windows\SysWOW64\Microsoft\Protect\ms.exe 8fa716e6d698cff761a257134fc0dcbc.exe File opened for modification C:\Windows\SysWOW64\Microsoft\Protect\ie.exe 8fa716e6d698cff761a257134fc0dcbc.exe -
Program crash 1 IoCs
Processes:
WerFault.exepid pid_target process target process 2080 2244 WerFault.exe 8fa716e6d698cff761a257134fc0dcbc.exe -
Kills process with taskkill 6 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exepid process 2196 taskkill.exe 4900 taskkill.exe 1260 taskkill.exe 3748 taskkill.exe 3164 taskkill.exe 2716 taskkill.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
8fa716e6d698cff761a257134fc0dcbc.exepid process 2244 8fa716e6d698cff761a257134fc0dcbc.exe 2244 8fa716e6d698cff761a257134fc0dcbc.exe 2244 8fa716e6d698cff761a257134fc0dcbc.exe 2244 8fa716e6d698cff761a257134fc0dcbc.exe -
Suspicious use of AdjustPrivilegeToken 5 IoCs
Processes:
taskkill.exetaskkill.exetaskkill.exetaskkill.exetaskkill.exedescription pid process Token: SeDebugPrivilege 3164 taskkill.exe Token: SeDebugPrivilege 2716 taskkill.exe Token: SeDebugPrivilege 2196 taskkill.exe Token: SeDebugPrivilege 1260 taskkill.exe Token: SeDebugPrivilege 3748 taskkill.exe -
Suspicious use of SetWindowsHookEx 5 IoCs
Processes:
8fa716e6d698cff761a257134fc0dcbc.exepid process 2244 8fa716e6d698cff761a257134fc0dcbc.exe 2244 8fa716e6d698cff761a257134fc0dcbc.exe 2244 8fa716e6d698cff761a257134fc0dcbc.exe 2244 8fa716e6d698cff761a257134fc0dcbc.exe 2244 8fa716e6d698cff761a257134fc0dcbc.exe -
Suspicious use of WriteProcessMemory 51 IoCs
Processes:
8fa716e6d698cff761a257134fc0dcbc.execmd.execmd.execmd.execmd.execmd.execmd.execmd.exedescription pid process target process PID 2244 wrote to memory of 656 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 656 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 656 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 656 wrote to memory of 1604 656 cmd.exe reg.exe PID 656 wrote to memory of 1604 656 cmd.exe reg.exe PID 656 wrote to memory of 1604 656 cmd.exe reg.exe PID 2244 wrote to memory of 3300 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 3300 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 3300 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 3300 wrote to memory of 3164 3300 cmd.exe taskkill.exe PID 3300 wrote to memory of 3164 3300 cmd.exe taskkill.exe PID 3300 wrote to memory of 3164 3300 cmd.exe taskkill.exe PID 2244 wrote to memory of 3856 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 3856 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 3856 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1020 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1020 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1020 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 1020 wrote to memory of 2716 1020 cmd.exe taskkill.exe PID 1020 wrote to memory of 2716 1020 cmd.exe taskkill.exe PID 1020 wrote to memory of 2716 1020 cmd.exe taskkill.exe PID 2244 wrote to memory of 3860 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 3860 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 3860 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1732 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1732 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1732 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 3860 wrote to memory of 908 3860 cmd.exe reg.exe PID 3860 wrote to memory of 908 3860 cmd.exe reg.exe PID 3860 wrote to memory of 908 3860 cmd.exe reg.exe PID 1732 wrote to memory of 2196 1732 cmd.exe taskkill.exe PID 1732 wrote to memory of 2196 1732 cmd.exe taskkill.exe PID 1732 wrote to memory of 2196 1732 cmd.exe taskkill.exe PID 2244 wrote to memory of 2548 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 2548 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 2548 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1524 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1524 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1524 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1424 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1424 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1424 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 1424 wrote to memory of 1260 1424 cmd.exe taskkill.exe PID 1424 wrote to memory of 1260 1424 cmd.exe taskkill.exe PID 1424 wrote to memory of 1260 1424 cmd.exe taskkill.exe PID 2244 wrote to memory of 1392 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1392 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 2244 wrote to memory of 1392 2244 8fa716e6d698cff761a257134fc0dcbc.exe cmd.exe PID 1392 wrote to memory of 3748 1392 cmd.exe taskkill.exe PID 1392 wrote to memory of 3748 1392 cmd.exe taskkill.exe PID 1392 wrote to memory of 3748 1392 cmd.exe taskkill.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\8fa716e6d698cff761a257134fc0dcbc.exe"C:\Users\Admin\AppData\Local\Temp\8fa716e6d698cff761a257134fc0dcbc.exe"1⤵
- Drops file in System32 directory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2244 -
C:\Windows\SysWOW64\cmd.execmd /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 0 /f && exit2⤵
- Suspicious use of WriteProcessMemory
PID:656 -
C:\Windows\SysWOW64\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 0 /f3⤵PID:1604
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im taskmgr.exe /t && exit && EXIT2⤵
- Suspicious use of WriteProcessMemory
PID:3300 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3164
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c cd C:\Users\Admin\AppData\Local\Temp && del blackhacker1298.exe && del upx.exe2⤵PID:3856
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im cmd.exe /t && exit2⤵
- Suspicious use of WriteProcessMemory
PID:1020 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im cmd.exe /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2716
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im taskmgr.exe /t && exit && EXIT2⤵
- Suspicious use of WriteProcessMemory
PID:1732 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2196
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c reg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 0 /f && exit2⤵
- Suspicious use of WriteProcessMemory
PID:3860 -
C:\Windows\SysWOW64\reg.exereg add HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Explorer\Advanced /v Hidden /t REG_DWORD /d 0 /f3⤵PID:908
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im taskmgr.exe /t && exit && EXIT2⤵PID:2548
-
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe /t3⤵
- Kills process with taskkill
PID:4900
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im taskmgr.exe /t && exit && EXIT2⤵PID:1524
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im taskmgr.exe /t && exit && EXIT2⤵
- Suspicious use of WriteProcessMemory
PID:1424 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:1260
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c taskkill /f /im taskmgr.exe /t && exit && EXIT2⤵
- Suspicious use of WriteProcessMemory
PID:1392 -
C:\Windows\SysWOW64\taskkill.exetaskkill /f /im taskmgr.exe /t3⤵
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:3748
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2244 -s 22722⤵
- Program crash
PID:2080
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 456 -p 2244 -ip 22441⤵PID:5060