Analysis
- max time kernel
136s - max time network
145s - platform
windows10-2004_x64 - resource
win10v2004-20240226-en - resource tags
arch:x64arch:x86image:win10v2004-20240226-enlocale:en-usos:windows10-2004-x64system - submitted
21/06/2024, 21:56
Behavioral task
behavioral1
Sample
main.exe
Resource
win7-20240611-en
windows7-x64
0 signatures
150 seconds
Behavioral task
behavioral2
Sample
main.exe
Resource
win10v2004-20240226-en
windows10-2004-x64
6 signatures
150 seconds
General
- Target main.exe
- Size 14.2MB
- Sample240621-1tlqjasdpc
- SHA256 9756e20697023876ef8e570658d2b35bed2548bf05c124b2f96f6203dae243c7
- MD5 2d48e14160b815234bfcc517f6500231
- SHA1 381c3152ca6ad548ea2bd8a83423e6e4bfe5508b
- SHA512 9c2c38a399c8d985ee058814bf87dad90347aed7faf2c9597f011da63fd7f6f6d405e689cf3be3c108f675bf4589ff078a8ecb2dba1bafc15aaa1ce9458e31b8
- SSDEEP 196608:IMhP4WgzpUmKAU/o4z3wVSIPLFFrL0AGtWT6U:IyP2mo40HLvL7Gty
- MD5 SHA1 SHA512 SSDEEP
Score
10/10
Malware Config
Extracted
Family
-
skuld
C2
-
https://discord.com/api/webhooks/1253813102223298560/O-L6iguyX5rluzD2U1_iyLQ7zm9faaFnF1M8hhYXbMbx7q6jl_GsrV427yX8oo062mN0
Signatures
- Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3808065738-1666277613-1125846146-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Realtek HD Audio Universal Service = "C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Protect\\SecurityHealthSystray.exe" main.exe - Looks up external IP address via web service 2 IoCs
Uses a legitimate IP lookup service to find the infected system's external IP.
flow ioc 1 api.ipify.org 2 api.ipify.org - Suspicious use of AdjustPrivilegeToken 43 IoCs
description pid Process Token: SeDebugPrivilege 5112 main.exe Token: SeIncreaseQuotaPrivilege 3120 wmic.exe Token: SeSecurityPrivilege 3120 wmic.exe Token: SeTakeOwnershipPrivilege 3120 wmic.exe Token: SeLoadDriverPrivilege 3120 wmic.exe Token: SeSystemProfilePrivilege 3120 wmic.exe Token: SeSystemtimePrivilege 3120 wmic.exe Token: SeProfSingleProcessPrivilege 3120 wmic.exe Token: SeIncBasePriorityPrivilege 3120 wmic.exe Token: SeCreatePagefilePrivilege 3120 wmic.exe Token: SeBackupPrivilege 3120 wmic.exe Token: SeRestorePrivilege 3120 wmic.exe Token: SeShutdownPrivilege 3120 wmic.exe Token: SeDebugPrivilege 3120 wmic.exe Token: SeSystemEnvironmentPrivilege 3120 wmic.exe Token: SeRemoteShutdownPrivilege 3120 wmic.exe Token: SeUndockPrivilege 3120 wmic.exe Token: SeManageVolumePrivilege 3120 wmic.exe Token: 33 3120 wmic.exe Token: 34 3120 wmic.exe Token: 35 3120 wmic.exe Token: 36 3120 wmic.exe Token: SeIncreaseQuotaPrivilege 3120 wmic.exe Token: SeSecurityPrivilege 3120 wmic.exe Token: SeTakeOwnershipPrivilege 3120 wmic.exe Token: SeLoadDriverPrivilege 3120 wmic.exe Token: SeSystemProfilePrivilege 3120 wmic.exe Token: SeSystemtimePrivilege 3120 wmic.exe Token: SeProfSingleProcessPrivilege 3120 wmic.exe Token: SeIncBasePriorityPrivilege 3120 wmic.exe Token: SeCreatePagefilePrivilege 3120 wmic.exe Token: SeBackupPrivilege 3120 wmic.exe Token: SeRestorePrivilege 3120 wmic.exe Token: SeShutdownPrivilege 3120 wmic.exe Token: SeDebugPrivilege 3120 wmic.exe Token: SeSystemEnvironmentPrivilege 3120 wmic.exe Token: SeRemoteShutdownPrivilege 3120 wmic.exe Token: SeUndockPrivilege 3120 wmic.exe Token: SeManageVolumePrivilege 3120 wmic.exe Token: 33 3120 wmic.exe Token: 34 3120 wmic.exe Token: 35 3120 wmic.exe Token: 36 3120 wmic.exe - Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 5112 wrote to memory of 1996 5112 main.exe 92 PID 5112 wrote to memory of 1996 5112 main.exe 92 PID 5112 wrote to memory of 3120 5112 main.exe 93 PID 5112 wrote to memory of 3120 5112 main.exe 93 PID 5112 wrote to memory of 4188 5112 main.exe 94 PID 5112 wrote to memory of 4188 5112 main.exe 94 - Views/modifies file attributes 1 TTPs 2 IoCs
pid Process 1996 attrib.exe 4188 attrib.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\main.exe"C:\Users\Admin\AppData\Local\Temp\main.exe"1⤵
- Adds Run key to start application
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:5112 -
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Local\Temp\main.exe2⤵
- Views/modifies file attributes
PID:1996
-
-
C:\Windows\System32\Wbem\wmic.exewmic csproduct get UUID2⤵
- Suspicious use of AdjustPrivilegeToken
PID:3120
-
-
C:\Windows\system32\attrib.exeattrib +h +s C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe2⤵
- Views/modifies file attributes
PID:4188
-
-
C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe"C:\Program Files (x86)\Microsoft\Edge\Application\msedge.exe" --type=utility --utility-sub-type=asset_store.mojom.AssetStoreService --lang=en-US --service-sandbox-type=asset_store_service --no-appcompat-clear --mojo-platform-channel-handle=4160 --field-trial-handle=3084,i,4016110471176367543,14287608422419064331,262144 --variations-seed-version /prefetch:81⤵PID:5088
Network
MITRE ATT&CK Enterprise v15
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Roaming\Microsoft\Protect\SecurityHealthSystray.exe
- Size 14.2MB
- SHA256 9756e20697023876ef8e570658d2b35bed2548bf05c124b2f96f6203dae243c7
- MD5 2d48e14160b815234bfcc517f6500231
- SHA1 381c3152ca6ad548ea2bd8a83423e6e4bfe5508b
- SHA512 9c2c38a399c8d985ee058814bf87dad90347aed7faf2c9597f011da63fd7f6f6d405e689cf3be3c108f675bf4589ff078a8ecb2dba1bafc15aaa1ce9458e31b8
- SSDEEP 196608:IMhP4WgzpUmKAU/o4z3wVSIPLFFrL0AGtWT6U:IyP2mo40HLvL7Gty
- MD5 SHA1 SHA512 SSDEEP