Analysis
-
max time kernel
150s -
max time network
151s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
28-02-2024 02:07
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
a76a616213578352655baa8ec670a4af.exe
Resource
win7-20240221-en
windows7-x64
12 signatures
150 seconds
Behavioral task
behavioral2
Sample
a76a616213578352655baa8ec670a4af.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
12 signatures
150 seconds
General
-
Target
a76a616213578352655baa8ec670a4af.exe
-
Size
154KB
-
MD5
a76a616213578352655baa8ec670a4af
-
SHA1
c49b7edec8d11906c6b9239b35ae3d9faaa75774
-
SHA256
cab445a0687a576ce30d1025dad52d36672aba94c0f6acfcf19b31ef4b9d44d8
-
SHA512
9eafa5e2207467b3062f5d031102d9d44c5d0c223a45c4033ea4701f97522a4a7c77d9d6001030b36143126252a87f85d300665ef73e4fa559121468d1e720b2
-
SSDEEP
3072:lK4X93xxRCcmwwOs2r/UlpyYreyzukwFrLlX+Sxd:l2OBoTdr03FrpX+od
Score
10/10
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 4 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List a76a616213578352655baa8ec670a4af.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile a76a616213578352655baa8ec670a4af.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications a76a616213578352655baa8ec670a4af.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\a76a616213578352655baa8ec670a4af.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\a76a616213578352655baa8ec670a4af.exe:*:Enabled:@xpsp2res.dll,-22019" a76a616213578352655baa8ec670a4af.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a76a616213578352655baa8ec670a4af.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" a76a616213578352655baa8ec670a4af.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UACDisableNotify = "0" a76a616213578352655baa8ec670a4af.exe -
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a76a616213578352655baa8ec670a4af.exe -
Writes to the Master Boot Record (MBR) 1 TTPs 1 IoCs
Bootkits write to the MBR to gain persistence at a level below the operating system.
description ioc Process File opened for modification \??\PhysicalDrive0 a76a616213578352655baa8ec670a4af.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 552 set thread context of 3680 552 a76a616213578352655baa8ec670a4af.exe 93 PID 3680 set thread context of 1032 3680 a76a616213578352655baa8ec670a4af.exe 94 -
Suspicious behavior: EnumeratesProcesses 28 IoCs
pid Process 552 a76a616213578352655baa8ec670a4af.exe 552 a76a616213578352655baa8ec670a4af.exe 552 a76a616213578352655baa8ec670a4af.exe 552 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe -
Suspicious use of AdjustPrivilegeToken 25 IoCs
description pid Process Token: SeBackupPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeAssignPrimaryTokenPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeAuditPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeBackupPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeChangeNotifyPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeCreatePagefilePrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeCreatePermanentPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeCreatePermanentPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeCreateTokenPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeIncBasePriorityPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeIncreaseQuotaPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeLoadDriverPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeLockMemoryPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeMachineAccountPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeProfSingleProcessPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeRemoteShutdownPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeRestorePrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeSecurityPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeShutdownPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeSystemEnvironmentPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeSystemProfilePrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeSystemtimePrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeTakeOwnershipPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeTcbPrivilege 3680 a76a616213578352655baa8ec670a4af.exe Token: SeDebugPrivilege 3680 a76a616213578352655baa8ec670a4af.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 552 a76a616213578352655baa8ec670a4af.exe 3680 a76a616213578352655baa8ec670a4af.exe -
Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 552 wrote to memory of 3680 552 a76a616213578352655baa8ec670a4af.exe 93 PID 552 wrote to memory of 3680 552 a76a616213578352655baa8ec670a4af.exe 93 PID 552 wrote to memory of 3680 552 a76a616213578352655baa8ec670a4af.exe 93 PID 552 wrote to memory of 3680 552 a76a616213578352655baa8ec670a4af.exe 93 PID 552 wrote to memory of 3680 552 a76a616213578352655baa8ec670a4af.exe 93 PID 552 wrote to memory of 3680 552 a76a616213578352655baa8ec670a4af.exe 93 PID 552 wrote to memory of 3680 552 a76a616213578352655baa8ec670a4af.exe 93 PID 3680 wrote to memory of 1032 3680 a76a616213578352655baa8ec670a4af.exe 94 PID 3680 wrote to memory of 1032 3680 a76a616213578352655baa8ec670a4af.exe 94 PID 3680 wrote to memory of 1032 3680 a76a616213578352655baa8ec670a4af.exe 94 PID 3680 wrote to memory of 1032 3680 a76a616213578352655baa8ec670a4af.exe 94 PID 3680 wrote to memory of 1032 3680 a76a616213578352655baa8ec670a4af.exe 94 PID 3680 wrote to memory of 1032 3680 a76a616213578352655baa8ec670a4af.exe 94 PID 3680 wrote to memory of 1032 3680 a76a616213578352655baa8ec670a4af.exe 94 PID 3680 wrote to memory of 1032 3680 a76a616213578352655baa8ec670a4af.exe 94 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" a76a616213578352655baa8ec670a4af.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a76a616213578352655baa8ec670a4af.exe"C:\Users\Admin\AppData\Local\Temp\a76a616213578352655baa8ec670a4af.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Users\Admin\AppData\Local\Temp\a76a616213578352655baa8ec670a4af.exeC:\Users\Admin\AppData\Local\Temp\a76a616213578352655baa8ec670a4af.exe2⤵
- Modifies firewall policy service
- UAC bypass
- Windows security bypass
- Windows security modification
- Checks whether UAC is enabled
- Writes to the Master Boot Record (MBR)
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- System policy modification
PID:3680 -
C:\Users\Admin\AppData\Local\Temp\a76a616213578352655baa8ec670a4af.exeC:\Users\Admin\AppData\Local\Temp\a76a616213578352655baa8ec670a4af.exe3⤵PID:1032
-
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Create or Modify System Process
1Windows Service
1Pre-OS Boot
1Bootkit
1Privilege Escalation
Abuse Elevation Control Mechanism
1Bypass User Account Control
1Create or Modify System Process
1Windows Service
1