Analysis
-
max time kernel
117s -
max time network
118s -
platform
windows7_x64 -
resource
win7-20240903-en -
resource tags
arch:x64arch:x86image:win7-20240903-enlocale:en-usos:windows7-x64system -
submitted
31/10/2024, 20:12
Static task
static1
1 signatures
Behavioral task
behavioral1
Sample
file.exe
Resource
win7-20240903-en
9 signatures
150 seconds
General
-
Target
file.exe
-
Size
6.1MB
-
MD5
015213997f4a1fc3503b19e2356738b2
-
SHA1
c24933a5005cc58fdacced124f93adb74c23748b
-
SHA256
b674f985f144f65b754715572db0cb17c0db762eb6d5217fbb93b15433572d97
-
SHA512
148e3833dd853881b5e8231fca26ba947dca9f5c0e783362c9afc97c10ee4bb392c26ecab57d90bdbaae8a39bc937798a2864cbdd92ef490af674a612863ddd4
-
SSDEEP
98304:tYweRLoL6mNCxDD/JXZU44RXgYja8MTyMfHN:9eRrmkRy5pjuT/N
Malware Config
Signatures
-
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file.exe -
Command and Scripting Interpreter: PowerShell 1 TTPs 1 IoCs
Run Powershell to modify Windows Defender settings to add exclusions for file extensions, paths, and processes.
pid Process 1608 powershell.exe -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA file.exe Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file.exe -
Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 2544 set thread context of 2136 2544 file.exe 35 -
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s).
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
pid Process 1608 powershell.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 2544 file.exe Token: SeDebugPrivilege 1608 powershell.exe -
Suspicious use of WriteProcessMemory 29 IoCs
description pid Process procid_target PID 2544 wrote to memory of 1608 2544 file.exe 32 PID 2544 wrote to memory of 1608 2544 file.exe 32 PID 2544 wrote to memory of 1608 2544 file.exe 32 PID 2544 wrote to memory of 352 2544 file.exe 34 PID 2544 wrote to memory of 352 2544 file.exe 34 PID 2544 wrote to memory of 352 2544 file.exe 34 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2136 2544 file.exe 35 PID 2544 wrote to memory of 2596 2544 file.exe 36 PID 2544 wrote to memory of 2596 2544 file.exe 36 PID 2544 wrote to memory of 2596 2544 file.exe 36 -
System policy modification 1 TTPs 1 IoCs
description ioc Process Set value (int) \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA = "0" file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\file.exe"C:\Users\Admin\AppData\Local\Temp\file.exe"1⤵
- UAC bypass
- Checks whether UAC is enabled
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
- System policy modification
PID:2544 -
C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\file.exe" -Force2⤵
- Command and Scripting Interpreter: PowerShell
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
PID:1608
-
-
C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"C:\Windows\Microsoft.NET\Framework64\v4.0.30319\ilasm.exe"2⤵PID:352
-
-
C:\Windows\explorer.exe"C:\Windows\explorer.exe"2⤵PID:2136
-
-
C:\Windows\system32\WerFault.exeC:\Windows\system32\WerFault.exe -u -p 2544 -s 6282⤵PID:2596
-