Analysis
-
max time kernel
149s -
max time network
150s -
platform
windows10-2004_x64 -
resource
win10v2004-20241007-en -
resource tags
arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system -
submitted
16/10/2024, 02:08
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
FaceBook Hack v1.0 + password.exe
Resource
win7-20241010-en
windows7-x64
20 signatures
150 seconds
General
-
Target
FaceBook Hack v1.0 + password.exe
-
Size
912KB
-
MD5
95229977f97839462edba92996248451
-
SHA1
184a8e50bb54b29c7ca08a75783bd9793a39e2a4
-
SHA256
056fb12baf9c25fd5b84208f63ad09033a5ec9500bc1e0acc50b81f4ea737577
-
SHA512
97175649cd62046075fa01a9302935f76ca11dec257de1ecfa26ce2ab6931b3ed9274324b2ed3ed638dac5cb5dc53272a6ff2cbe2b3646af7307cf335363ef3a
-
SSDEEP
24576:O4SKodZAdlSqMRPyrEexQx0yOoeiIVHm+D9Vt6qLwkSy5XB6eXVUr/8GswBAiLYj:O4SKodZAdlSqMRPyrEexQx0yOoeiIVHt
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\UserInit = "C:\\Windows\\system32\\userinit.exe,C:\\Windupdt\\winupdate.exe" FaceBook Hack v1.0 + password.exe -
Modifies firewall policy service 3 TTPs 3 IoCs
description ioc Process Key created \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile winupdate.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\EnableFirewall = "0" winupdate.exe Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\DisableNotifications = "0" winupdate.exe -
Modifies security service 2 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\wscsvc\Start = "4" winupdate.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe -
Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate FaceBook Hack v1.0 + password.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosDate winupdate.exe -
Checks computer location settings 2 TTPs 1 IoCs
Looks up country code configured in the registry, likely geofence.
description ioc Process Key value queried \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\Control Panel\International\Geo\Nation FaceBook Hack v1.0 + password.exe -
Deletes itself 1 IoCs
pid Process 2488 notepad.exe -
Executes dropped EXE 2 IoCs
pid Process 2440 winupdate.exe 3796 winupdate.exe -
description ioc Process Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\AntiVirusDisableNotify = "1" winupdate.exe Set value (str) \REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Security Center\UpdatesDisableNotify = "1" winupdate.exe -
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" FaceBook Hack v1.0 + password.exe Set value (str) \REGISTRY\USER\S-1-5-21-3227495264-2217614367-4027411560-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\winupdater = "C:\\Windupdt\\winupdate.exe" notepad.exe -
Suspicious use of SetThreadContext 2 IoCs
description pid Process procid_target PID 4480 set thread context of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 2440 set thread context of 3796 2440 winupdate.exe 107 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Program crash 2 IoCs
pid pid_target Process procid_target 1176 4480 WerFault.exe 83 3028 2440 WerFault.exe 100 -
System Location Discovery: System Language Discovery 1 TTPs 6 IoCs
Attempt gather information about the system language of a victim in order to infer the geographical location of that host.
description ioc Process Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language winupdate.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FaceBook Hack v1.0 + password.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language FaceBook Hack v1.0 + password.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Control\NLS\Language notepad.exe -
Checks processor information in registry 2 TTPs 8 IoCs
Processor information is often read in order to detect sandboxing environments.
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier winupdate.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 FaceBook Hack v1.0 + password.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString FaceBook Hack v1.0 + password.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\Identifier FaceBook Hack v1.0 + password.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\VendorIdentifier FaceBook Hack v1.0 + password.exe Key opened \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0 winupdate.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString winupdate.exe -
Enumerates system info in registry 2 TTPs 2 IoCs
description ioc Process Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier FaceBook Hack v1.0 + password.exe Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\Identifier winupdate.exe -
Suspicious use of AdjustPrivilegeToken 48 IoCs
description pid Process Token: SeIncreaseQuotaPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeSecurityPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeTakeOwnershipPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeLoadDriverPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeSystemProfilePrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeSystemtimePrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeProfSingleProcessPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeIncBasePriorityPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeCreatePagefilePrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeBackupPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeRestorePrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeShutdownPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeDebugPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeSystemEnvironmentPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeChangeNotifyPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeRemoteShutdownPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeUndockPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeManageVolumePrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeImpersonatePrivilege 1896 FaceBook Hack v1.0 + password.exe Token: SeCreateGlobalPrivilege 1896 FaceBook Hack v1.0 + password.exe Token: 33 1896 FaceBook Hack v1.0 + password.exe Token: 34 1896 FaceBook Hack v1.0 + password.exe Token: 35 1896 FaceBook Hack v1.0 + password.exe Token: 36 1896 FaceBook Hack v1.0 + password.exe Token: SeIncreaseQuotaPrivilege 3796 winupdate.exe Token: SeSecurityPrivilege 3796 winupdate.exe Token: SeTakeOwnershipPrivilege 3796 winupdate.exe Token: SeLoadDriverPrivilege 3796 winupdate.exe Token: SeSystemProfilePrivilege 3796 winupdate.exe Token: SeSystemtimePrivilege 3796 winupdate.exe Token: SeProfSingleProcessPrivilege 3796 winupdate.exe Token: SeIncBasePriorityPrivilege 3796 winupdate.exe Token: SeCreatePagefilePrivilege 3796 winupdate.exe Token: SeBackupPrivilege 3796 winupdate.exe Token: SeRestorePrivilege 3796 winupdate.exe Token: SeShutdownPrivilege 3796 winupdate.exe Token: SeDebugPrivilege 3796 winupdate.exe Token: SeSystemEnvironmentPrivilege 3796 winupdate.exe Token: SeChangeNotifyPrivilege 3796 winupdate.exe Token: SeRemoteShutdownPrivilege 3796 winupdate.exe Token: SeUndockPrivilege 3796 winupdate.exe Token: SeManageVolumePrivilege 3796 winupdate.exe Token: SeImpersonatePrivilege 3796 winupdate.exe Token: SeCreateGlobalPrivilege 3796 winupdate.exe Token: 33 3796 winupdate.exe Token: 34 3796 winupdate.exe Token: 35 3796 winupdate.exe Token: 36 3796 winupdate.exe -
Suspicious use of SetWindowsHookEx 2 IoCs
pid Process 4480 FaceBook Hack v1.0 + password.exe 2440 winupdate.exe -
Suspicious use of WriteProcessMemory 64 IoCs
description pid Process procid_target PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 4480 wrote to memory of 1896 4480 FaceBook Hack v1.0 + password.exe 97 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 2220 1896 FaceBook Hack v1.0 + password.exe 98 PID 1896 wrote to memory of 3588 1896 FaceBook Hack v1.0 + password.exe 99 PID 1896 wrote to memory of 3588 1896 FaceBook Hack v1.0 + password.exe 99 PID 1896 wrote to memory of 3588 1896 FaceBook Hack v1.0 + password.exe 99 PID 1896 wrote to memory of 2440 1896 FaceBook Hack v1.0 + password.exe 100 PID 1896 wrote to memory of 2440 1896 FaceBook Hack v1.0 + password.exe 100 PID 1896 wrote to memory of 2440 1896 FaceBook Hack v1.0 + password.exe 100 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 1896 wrote to memory of 2488 1896 FaceBook Hack v1.0 + password.exe 101 PID 2440 wrote to memory of 3796 2440 winupdate.exe 107 PID 2440 wrote to memory of 3796 2440 winupdate.exe 107 PID 2440 wrote to memory of 3796 2440 winupdate.exe 107 PID 2440 wrote to memory of 3796 2440 winupdate.exe 107
Processes
-
C:\Users\Admin\AppData\Local\Temp\FaceBook Hack v1.0 + password.exe"C:\Users\Admin\AppData\Local\Temp\FaceBook Hack v1.0 + password.exe"1⤵
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:4480 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4480 -s 7242⤵
- Program crash
PID:1176
-
-
C:\Users\Admin\AppData\Local\Temp\FaceBook Hack v1.0 + password.exe"C:\Users\Admin\AppData\Local\Temp\FaceBook Hack v1.0 + password.exe"2⤵
- Modifies WinLogon for persistence
- Checks BIOS information in registry
- Checks computer location settings
- Adds Run key to start application
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1896 -
C:\Windows\SysWOW64\notepad.exenotepad3⤵
- Adds Run key to start application
- System Location Discovery: System Language Discovery
PID:2220
-
-
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"3⤵PID:3588
-
-
C:\Windupdt\winupdate.exe"C:\Windupdt\winupdate.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- System Location Discovery: System Language Discovery
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:2440 -
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2440 -s 7244⤵
- Program crash
PID:3028
-
-
C:\Windupdt\winupdate.exeC:\Windupdt\winupdate.exe4⤵
- Modifies firewall policy service
- Modifies security service
- Windows security bypass
- Checks BIOS information in registry
- Executes dropped EXE
- Windows security modification
- System Location Discovery: System Language Discovery
- Checks processor information in registry
- Enumerates system info in registry
- Suspicious use of AdjustPrivilegeToken
PID:3796 -
C:\Windows\SysWOW64\explorer.exe"C:\Windows\SysWOW64\explorer.exe"5⤵PID:2212
-
-
-
-
C:\Windows\SysWOW64\notepad.exeC:\Windows\SysWOW64\notepad.exe3⤵
- Deletes itself
- System Location Discovery: System Language Discovery
PID:2488
-
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 420 -p 4480 -ip 44801⤵PID:1336
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 520 -p 2440 -ip 24401⤵PID:1424
Network
MITRE ATT&CK Enterprise v15
Persistence
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Privilege Escalation
Boot or Logon Autostart Execution
2Registry Run Keys / Startup Folder
1Winlogon Helper DLL
1Create or Modify System Process
2Windows Service
2Defense Evasion
Impair Defenses
3Disable or Modify System Firewall
1Disable or Modify Tools
2Modify Registry
6Replay Monitor
Loading Replay Monitor...
Downloads
-
Filesize
912KB
MD595229977f97839462edba92996248451
SHA1184a8e50bb54b29c7ca08a75783bd9793a39e2a4
SHA256056fb12baf9c25fd5b84208f63ad09033a5ec9500bc1e0acc50b81f4ea737577
SHA51297175649cd62046075fa01a9302935f76ca11dec257de1ecfa26ce2ab6931b3ed9274324b2ed3ed638dac5cb5dc53272a6ff2cbe2b3646af7307cf335363ef3a