Analysis
-
max time kernel
53s -
max time network
54s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
07-10-2024 18:26
Behavioral task
behavioral1
Sample
112.exe
Resource
win10v2004-20241007-en
windows10-2004-x64
15 signatures
150 seconds
General
-
Target
112.exe
-
Size
37KB
-
MD5
775ede65fe22dc4724978776059def38
-
SHA1
634c5a46c5f1efa7d7eb12a7cece5dbe8d711459
-
SHA256
51616cd30d1ac7c0be195080b343766fdd9146bfae6f9fd4e3419edde7db6446
-
SHA512
2478996190fcc3685024b5ddd9d5f709a442c99748b3b53eb53ec8d6dbb94da5f15cf8338cf2a7cf256285fe782e64f7f205a21be8d3ac8d85f2b3be790ff1bd
-
SSDEEP
384:qYprOIiuPjtD+P3V+y0b1gBUtPr2s2M+frAF+rMRTyN/0L+EcoinblneHQM3epzm:hprnmV10b1gBUt6lMErM+rMRa8NuENt
Malware Config
Signatures
-
Modifies Windows Firewall 2 TTPs 1 IoCs
pid Process 4880 netsh.exe -
Drops startup file 2 IoCs
description ioc Process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\61d9687d845725f5441dd4ecb23dd5af.exe 112.exe File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\61d9687d845725f5441dd4ecb23dd5af.exe 112.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\61d9687d845725f5441dd4ecb23dd5af = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\112.exe\" .." 112.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows\CurrentVersion\Run\61d9687d845725f5441dd4ecb23dd5af = "\"C:\\Users\\Admin\\AppData\\Local\\Temp\\112.exe\" .." 112.exe -
Drops autorun.inf file 1 TTPs 5 IoCs
Malware can abuse Windows Autorun to spread further via attached volumes.
description ioc Process File created C:\autorun.inf 112.exe File opened for modification C:\autorun.inf 112.exe File created D:\autorun.inf 112.exe File created F:\autorun.inf 112.exe File opened for modification F:\autorun.inf 112.exe -
Event Triggered Execution: Netsh Helper DLL 1 TTPs 3 IoCs
Netsh.exe (also referred to as Netshell) is a command-line scripting utility used to interact with the network configuration of a system.
description ioc Process Key value enumerated \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key opened \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe Key queried \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\NetSh netsh.exe -
System Location Discovery: System Language Discovery 1 TTPs 3 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language 112.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language netsh.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language taskkill.exe -
Checks SCSI registry key(s) 3 TTPs 3 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\Properties\{b725f130-47ef-101a-a5f1-02608c9eebac}\000A taskmgr.exe Key value queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000\FriendlyName taskmgr.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI\Disk&Ven_WDC&Prod_WDS100T2B0A\4&215468a5&0&000000 taskmgr.exe -
Kills process with taskkill 1 IoCs
pid Process 2344 taskkill.exe -
Modifies registry class 1 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000_Classes\Local Settings taskmgr.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 552 112.exe 1928 taskmgr.exe 1928 taskmgr.exe 552 112.exe 552 112.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 552 112.exe -
Suspicious use of AdjustPrivilegeToken 17 IoCs
description pid Process Token: SeDebugPrivilege 552 112.exe Token: SeDebugPrivilege 2344 taskkill.exe Token: SeDebugPrivilege 1928 taskmgr.exe Token: SeSystemProfilePrivilege 1928 taskmgr.exe Token: SeCreateGlobalPrivilege 1928 taskmgr.exe Token: 33 552 112.exe Token: SeIncBasePriorityPrivilege 552 112.exe Token: 33 552 112.exe Token: SeIncBasePriorityPrivilege 552 112.exe Token: 33 552 112.exe Token: SeIncBasePriorityPrivilege 552 112.exe Token: 33 552 112.exe Token: SeIncBasePriorityPrivilege 552 112.exe Token: 33 552 112.exe Token: SeIncBasePriorityPrivilege 552 112.exe Token: 33 552 112.exe Token: SeIncBasePriorityPrivilege 552 112.exe -
Suspicious use of FindShellTrayWindow 56 IoCs
pid Process 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe -
Suspicious use of SendNotifyMessage 56 IoCs
pid Process 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe 1928 taskmgr.exe -
Suspicious use of WriteProcessMemory 6 IoCs
description pid Process procid_target PID 552 wrote to memory of 4880 552 112.exe 85 PID 552 wrote to memory of 4880 552 112.exe 85 PID 552 wrote to memory of 4880 552 112.exe 85 PID 552 wrote to memory of 2344 552 112.exe 87 PID 552 wrote to memory of 2344 552 112.exe 87 PID 552 wrote to memory of 2344 552 112.exe 87
Processes
-
C:\Users\Admin\AppData\Local\Temp\112.exe"C:\Users\Admin\AppData\Local\Temp\112.exe"1⤵
- Drops startup file
- Adds Run key to start application
- Drops autorun.inf file
- System Location Discovery: System Language Discovery
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:552 -
C:\Windows\SysWOW64\netsh.exenetsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\112.exe" "112.exe" ENABLE2⤵
- Modifies Windows Firewall
- Event Triggered Execution: Netsh Helper DLL
- System Location Discovery: System Language Discovery
PID:4880
-
-
C:\Windows\SysWOW64\taskkill.exetaskkill /F /IM Exsample.exe2⤵
- System Location Discovery: System Language Discovery
- Kills process with taskkill
- Suspicious use of AdjustPrivilegeToken
PID:2344
-
-
C:\Windows\system32\taskmgr.exe"C:\Windows\system32\taskmgr.exe" /41⤵
- Checks SCSI registry key(s)
- Modifies registry class
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1928
-
C:\Windows\System32\rundll32.exeC:\Windows\System32\rundll32.exe C:\Windows\System32\shell32.dll,SHCreateLocalServerRunDll {9aa46009-3ce0-458a-a354-715610a075e6} -Embedding1⤵PID:1076
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Privilege Escalation
Boot or Logon Autostart Execution
1Registry Run Keys / Startup Folder
1Create or Modify System Process
1Windows Service
1Event Triggered Execution
1Netsh Helper DLL
1Defense Evasion
Impair Defenses
1Disable or Modify System Firewall
1Modify Registry
1Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
37KB
MD5775ede65fe22dc4724978776059def38
SHA1634c5a46c5f1efa7d7eb12a7cece5dbe8d711459
SHA25651616cd30d1ac7c0be195080b343766fdd9146bfae6f9fd4e3419edde7db6446
SHA5122478996190fcc3685024b5ddd9d5f709a442c99748b3b53eb53ec8d6dbb94da5f15cf8338cf2a7cf256285fe782e64f7f205a21be8d3ac8d85f2b3be790ff1bd