Analysis
-
max time kernel
92s -
max time network
95s -
platform
windows10-2004_x64 -
resource
win10v2004-20240220-en -
resource tags
arch:x64arch:x86image:win10v2004-20240220-enlocale:en-usos:windows10-2004-x64system -
submitted
21-02-2024 13:20
Behavioral task
behavioral1
Sample
ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe
Resource
win7-20231215-en
Behavioral task
behavioral2
Sample
ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe
Resource
win10v2004-20240220-en
General
-
Target
ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe
-
Size
37KB
-
MD5
ac30a06bb9c7b5cc0e18b9bfc9e54bd9
-
SHA1
7232e66f7417fcb96ca2b6dc5207b0b823be1462
-
SHA256
cef570542198bfab9319da2c3068da34484f72d77e5437f3f0592d26b26aaf69
-
SHA512
e3a467e22e088cc60507ce48be58a439a8b06bd2e2fa1c407acd2cf821757f54070cce6902e5a13b5de23cd1b963cb5e1d7ba23564b641793f2fe834dfc2398d
-
SSDEEP
384:id7pTgiG1C/ZfursvO6yszSLoPZYTn+LKrAF+rMRTyN/0L+EcoinblneHQM3epzg:opP5WpszSLoWT+WrM+rMRa8Nu6ht
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 2 IoCs
Processes:
netsh.exenetsh.exepid process 1912 netsh.exe 3836 netsh.exe -
Drops startup file 2 IoCs
Processes:
ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1c7d94c93e29463dd3914e19ee6714b6.exe ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\1c7d94c93e29463dd3914e19ee6714b6.exe ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1888637039-960448630-940472005-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\1c7d94c93e29463dd3914e19ee6714b6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe\" .." ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\1c7d94c93e29463dd3914e19ee6714b6 = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe\" .." ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe -
Legitimate hosting services abused for malware hosting/C2 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exepid process 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exepid process 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe -
Suspicious use of AdjustPrivilegeToken 7 IoCs
Processes:
ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exedescription pid process Token: SeDebugPrivilege 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe Token: 33 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe Token: SeIncBasePriorityPrivilege 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe Token: 33 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe Token: SeIncBasePriorityPrivilege 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe Token: 33 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe Token: SeIncBasePriorityPrivilege 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe -
Suspicious use of WriteProcessMemory 12 IoCs
Processes:
ac30a06bb9c7b5cc0e18b9bfc9e54bd9.execmd.exedescription pid process target process PID 3024 wrote to memory of 1912 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe netsh.exe PID 3024 wrote to memory of 1912 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe netsh.exe PID 3024 wrote to memory of 1912 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe netsh.exe PID 3024 wrote to memory of 3836 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe netsh.exe PID 3024 wrote to memory of 3836 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe netsh.exe PID 3024 wrote to memory of 3836 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe netsh.exe PID 3024 wrote to memory of 1564 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe cmd.exe PID 3024 wrote to memory of 1564 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe cmd.exe PID 3024 wrote to memory of 1564 3024 ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe cmd.exe PID 1564 wrote to memory of 1412 1564 cmd.exe PING.EXE PID 1564 wrote to memory of 1412 1564 cmd.exe PING.EXE PID 1564 wrote to memory of 1412 1564 cmd.exe PING.EXE
Processes
-
C:\Users\Admin\AppData\Local\Temp\ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe"C:\Users\Admin\AppData\Local\Temp\ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe" "ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe" ENABLE2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\netsh.exenetsh firewall delete allowedprogram "C:\Users\Admin\AppData\Local\Temp\ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe"2⤵
- Modifies Windows Firewall
-
C:\Windows\SysWOW64\cmd.execmd.exe /k ping 0 & del "C:\Users\Admin\AppData\Local\Temp\ac30a06bb9c7b5cc0e18b9bfc9e54bd9.exe" & exit2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 03⤵
- Runs ping.exe
Network
MITRE ATT&CK Matrix ATT&CK v13
Persistence
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Privilege Escalation
Create or Modify System Process
1Windows Service
1Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/3024-0-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/3024-2-0x00000000014A0000-0x00000000014B0000-memory.dmpFilesize
64KB
-
memory/3024-1-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/3024-4-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/3024-5-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB
-
memory/3024-6-0x00000000014A0000-0x00000000014B0000-memory.dmpFilesize
64KB
-
memory/3024-7-0x00000000014A0000-0x00000000014B0000-memory.dmpFilesize
64KB
-
memory/3024-11-0x0000000074620000-0x0000000074BD1000-memory.dmpFilesize
5.7MB