Analysis
-
max time kernel
121s -
max time network
123s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 20:03
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
9 signatures
150 seconds
General
-
Target
file.exe
-
Size
6.1MB
-
MD5
015213997f4a1fc3503b19e2356738b2
-
SHA1
c24933a5005cc58fdacced124f93adb74c23748b
-
SHA256
b674f985f144f65b754715572db0cb17c0db762eb6d5217fbb93b15433572d97
-
SHA512
148e3833dd853881b5e8231fca26ba947dca9f5c0e783362c9afc97c10ee4bb392c26ecab57d90bdbaae8a39bc937798a2864cbdd92ef490af674a612863ddd4
-
SSDEEP
98304:tYweRLoL6mNCxDD/JXZU44RXgYja8MTyMfHN:9eRrmkRy5pjuT/N
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 780 powershell.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2552 set thread context of 2704 2552 file.exe 34 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 780 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2552 file.exe Token: SeDebugPrivilege 780 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2552 wrote to memory of 780 2552 file.exe 31 PID 2552 wrote to memory of 780 2552 file.exe 31 PID 2552 wrote to memory of 780 2552 file.exe 31 PID 2552 wrote to memory of 1936 2552 file.exe 33 PID 2552 wrote to memory of 1936 2552 file.exe 33 PID 2552 wrote to memory of 1936 2552 file.exe 33 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2704 2552 file.exe 34 PID 2552 wrote to memory of 2276 2552 file.exe 35 PID 2552 wrote to memory of 2276 2552 file.exe 35 PID 2552 wrote to memory of 2276 2552 file.exe 35 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2552 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:780
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"2⤵PID:1936
-
-
C:\Program Files\Internet Explorer\iexplore.exe"C:\Program Files\Internet Explorer\iexplore.exe"2⤵PID:2704
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2552 -s 7082⤵PID:2276
-