Analysis
-
max time kernel
148s -
max time network
138s -
platform
windows10-2004_x64 -
resource
win10v2004-20240226-en -
resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system -
submitted
29/02/2024, 03:25
Static task
static1
Behavioral task
behavioral1
Sample
ad909fb29790b397f57d0b1255483e57.exe
Resource
win7-20240221-en
Behavioral task
behavioral2
Sample
ad909fb29790b397f57d0b1255483e57.exe
Resource
win10v2004-20240226-en
General
-
Target
ad909fb29790b397f57d0b1255483e57.exe
-
Size
528KB
-
MD5
ad909fb29790b397f57d0b1255483e57
-
SHA1
54e661feab037dbbf41604c57affc0c8b8fd3722
-
SHA256
81f8a7a48e1c543a1a4ac04a056634861b129cf07a7f63711b535a4e6850095d
-
SHA512
c36053d613e868e62ab3ad25c6ef9b9159807b356ce72036d06833e7e052c69b8f260bbe2290afc54a924d85487e8248c8dd8d4205b01c2d4f41941eafd5f143
-
SSDEEP
12288:JXehr3BbkJbZQ2kTCfNOVFILo1iLUGXfX02iduXzpnVCqJd35j:U3BkJ1ZkW16Kcwnpo0NQqJF
Malware Config
Signatures
-
Modifies firewall policy service 2 TTPs 10 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DoNotAllowExceptions = "0" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Roaming\HAXBS.exe = "C:\\Users\\Admin\\AppData\\Roaming\\HAXBS.exe:*:Enabled:Windows Messanger" reg.exe Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List reg.exe Set value (str) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List\C:\Users\Admin\AppData\Local\Temp\ad909fb29790b397f57d0b1255483e57.exe = "C:\\Users\\Admin\\AppData\\Local\\Temp\\ad909fb29790b397f57d0b1255483e57.exe:*:Enabled:Windows Messanger" reg.exe -
Adds policy Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run wmpnetk.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\HAXBS.exe" wmpnetk.exe -
Modifies Installed Components in the registry 2 TTPs 4 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1ABF60C-ACF1-C1F3-CDFA-AF25FBF22AA3}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\HAXBS.exe" wmpnetk.exe Key created \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{B1ABF60C-ACF1-C1F3-CDFA-AF25FBF22AA3} wmpnetk.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Active Setup\Installed Components\{B1ABF60C-ACF1-C1F3-CDFA-AF25FBF22AA3}\StubPath = "C:\\Users\\Admin\\AppData\\Roaming\\HAXBS.exe" wmpnetk.exe Key created \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Active Setup\Installed Components\{B1ABF60C-ACF1-C1F3-CDFA-AF25FBF22AA3} wmpnetk.exe -
Executes dropped EXE 1 IoCs
pid Process 4836 wmpnetk.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\HAXBS.exe" wmpnetk.exe Set value (str) \REGISTRY\USER\S-1-5-21-275798769-4264537674-1142822080-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Windows Update = "C:\\Users\\Admin\\AppData\\Roaming\\HAXBS.exe" wmpnetk.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4572 set thread context of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 -
Modifies registry key 1 TTPs 4 IoCs
pid Process 684 reg.exe 1984 reg.exe 4924 reg.exe 1524 reg.exe -
Suspicious use of AdjustPrivilegeToken 35 IoCs
description pid Process Token: 1 4836 wmpnetk.exe Token: SeCreateTokenPrivilege 4836 wmpnetk.exe Token: SeAssignPrimaryTokenPrivilege 4836 wmpnetk.exe Token: SeLockMemoryPrivilege 4836 wmpnetk.exe Token: SeIncreaseQuotaPrivilege 4836 wmpnetk.exe Token: SeMachineAccountPrivilege 4836 wmpnetk.exe Token: SeTcbPrivilege 4836 wmpnetk.exe Token: SeSecurityPrivilege 4836 wmpnetk.exe Token: SeTakeOwnershipPrivilege 4836 wmpnetk.exe Token: SeLoadDriverPrivilege 4836 wmpnetk.exe Token: SeSystemProfilePrivilege 4836 wmpnetk.exe Token: SeSystemtimePrivilege 4836 wmpnetk.exe Token: SeProfSingleProcessPrivilege 4836 wmpnetk.exe Token: SeIncBasePriorityPrivilege 4836 wmpnetk.exe Token: SeCreatePagefilePrivilege 4836 wmpnetk.exe Token: SeCreatePermanentPrivilege 4836 wmpnetk.exe Token: SeBackupPrivilege 4836 wmpnetk.exe Token: SeRestorePrivilege 4836 wmpnetk.exe Token: SeShutdownPrivilege 4836 wmpnetk.exe Token: SeDebugPrivilege 4836 wmpnetk.exe Token: SeAuditPrivilege 4836 wmpnetk.exe Token: SeSystemEnvironmentPrivilege 4836 wmpnetk.exe Token: SeChangeNotifyPrivilege 4836 wmpnetk.exe Token: SeRemoteShutdownPrivilege 4836 wmpnetk.exe Token: SeUndockPrivilege 4836 wmpnetk.exe Token: SeSyncAgentPrivilege 4836 wmpnetk.exe Token: SeEnableDelegationPrivilege 4836 wmpnetk.exe Token: SeManageVolumePrivilege 4836 wmpnetk.exe Token: SeImpersonatePrivilege 4836 wmpnetk.exe Token: SeCreateGlobalPrivilege 4836 wmpnetk.exe Token: 31 4836 wmpnetk.exe Token: 32 4836 wmpnetk.exe Token: 33 4836 wmpnetk.exe Token: 34 4836 wmpnetk.exe Token: 35 4836 wmpnetk.exe -
Suspicious use of SetWindowsHookEx 3 IoCs
pid Process 4836 wmpnetk.exe 4836 wmpnetk.exe 4836 wmpnetk.exe -
Suspicious use of WriteProcessMemory 39 IoCs
description pid Process procid_target PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 4836 4572 ad909fb29790b397f57d0b1255483e57.exe 92 PID 4572 wrote to memory of 2916 4572 ad909fb29790b397f57d0b1255483e57.exe 93 PID 4572 wrote to memory of 2916 4572 ad909fb29790b397f57d0b1255483e57.exe 93 PID 4572 wrote to memory of 2916 4572 ad909fb29790b397f57d0b1255483e57.exe 93 PID 4836 wrote to memory of 2576 4836 wmpnetk.exe 99 PID 4836 wrote to memory of 2576 4836 wmpnetk.exe 99 PID 4836 wrote to memory of 2576 4836 wmpnetk.exe 99 PID 4836 wrote to memory of 2584 4836 wmpnetk.exe 98 PID 4836 wrote to memory of 2584 4836 wmpnetk.exe 98 PID 4836 wrote to memory of 2584 4836 wmpnetk.exe 98 PID 4836 wrote to memory of 4192 4836 wmpnetk.exe 97 PID 4836 wrote to memory of 4192 4836 wmpnetk.exe 97 PID 4836 wrote to memory of 4192 4836 wmpnetk.exe 97 PID 4836 wrote to memory of 468 4836 wmpnetk.exe 96 PID 4836 wrote to memory of 468 4836 wmpnetk.exe 96 PID 4836 wrote to memory of 468 4836 wmpnetk.exe 96 PID 4192 wrote to memory of 4924 4192 cmd.exe 105 PID 4192 wrote to memory of 4924 4192 cmd.exe 105 PID 4192 wrote to memory of 4924 4192 cmd.exe 105 PID 2576 wrote to memory of 1984 2576 cmd.exe 104 PID 2576 wrote to memory of 1984 2576 cmd.exe 104 PID 2576 wrote to memory of 1984 2576 cmd.exe 104 PID 468 wrote to memory of 1524 468 cmd.exe 106 PID 468 wrote to memory of 1524 468 cmd.exe 106 PID 468 wrote to memory of 1524 468 cmd.exe 106 PID 2584 wrote to memory of 684 2584 cmd.exe 107 PID 2584 wrote to memory of 684 2584 cmd.exe 107 PID 2584 wrote to memory of 684 2584 cmd.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\ad909fb29790b397f57d0b1255483e57.exe"C:\Users\Admin\AppData\Local\Temp\ad909fb29790b397f57d0b1255483e57.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4572 -
C:\Users\Admin\AppData\Local\Temp\wmpnetk.exeC:\Users\Admin\AppData\Local\Temp\wmpnetk.exe2⤵
- Adds policy Run key to start application
- Modifies Installed Components in the registry
- Executes dropped EXE
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4836 -
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\HAXBS.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\HAXBS.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:468 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Roaming\HAXBS.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Roaming\HAXBS.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1524
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:4192 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:4924
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ad909fb29790b397f57d0b1255483e57.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ad909fb29790b397f57d0b1255483e57.exe:*:Enabled:Windows Messanger" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2584 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List /v "C:\Users\Admin\AppData\Local\Temp\ad909fb29790b397f57d0b1255483e57.exe" /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\ad909fb29790b397f57d0b1255483e57.exe:*:Enabled:Windows Messanger" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:684
-
-
-
C:\Windows\SysWOW64\cmd.execmd /c REG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f3⤵
- Suspicious use of WriteProcessMemory
PID:2576 -
C:\Windows\SysWOW64\reg.exeREG ADD HKLM\System\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile /v "DoNotAllowExceptions" /t REG_DWORD /d "0" /f4⤵
- Modifies firewall policy service
- Modifies registry key
PID:1984
-
-
-
-
C:\Windows\SysWOW64\cmd.exe"cmd"2⤵PID:2916
-
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
3Registry Run Keys / Startup Folder
3Create or Modify System Process
1Windows Service
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
1.1MB
MD5d881de17aa8f2e2c08cbb7b265f928f9
SHA108936aebc87decf0af6e8eada191062b5e65ac2a
SHA256b3a37093609f9a20ad60b85a9fa9de2ba674cba9b5bd687729440c70ba619ca0
SHA5125f23bfb1b8740247b36ed0ab741738c7d4c949736129e767213e321607d1ccd3e3a8428e4ba44bd28a275b5e3f6206285b1a522514b7ef7ea5e698d90a713d34
-
Filesize
448KB
MD5e4724f3428b0fe75e91e14472f3465bf
SHA16166b54ca1279d43bbca36aec1d071db2432f005
SHA256e20bd8215eeacd1139d6bc9542c0a4818b50a6418def41086f33597d85e929a5
SHA51204efdae4d0a0d98df53c75f212e927ce1b744d0f1fe45308864aff0fa7bb91476797f7e5723fd0dc9197a7bbc840f8e8505d4f996e332a3a19900723ea69428b