Overview

overview

8

task1

 

8

task2

 

6

Analysis

  • max time kernel
    150s
  • max time network
    150s
  • resource
    win7v191014
  • submitted
    04-02-2020 18:26

Sharing

Copy URL
Twitter E-mail

General

  • Target

    processhacker-2.39-bin.zip

  • Sample

    200204-865pdj5kzs

  • SHA256

    2afb5303e191dde688c5626c3ee545e32e52f09da3b35b20f5e0d29a418432f5

Score
8/10
persistenceevasionspywaretrojan

Malware Config

Signatures

  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Detect's application with GUI, possible interaction needed.
  • Suspicious use of AdjustPrivilegeToken 16 IoCs
  • Executes dropped EXE 3 IoCs
  • Modifies service 2 TTPs 3 IoCs
    persistence
  • Checks processor information in registry 2 TTPs 2 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Suspicious behavior: EnumeratesProcesses 3 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 2 IoCs
  • Modifies Internet Explorer settings 1 TTPs 38 IoCs
    adwarespyware
  • Suspicious use of SetWindowsHookEx 2 IoCs
  • Loads dropped DLL 4 IoCs
  • Suspicious behavior: LoadsDriver 1 IoCs
  • Drops file in Program Files directory 66 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs
  • Modifies system certificate store 2 TTPs 17 IoCs
    evasionspywaretrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe
    "C:\Users\Admin\AppData\Local\Temp\ProcessHacker.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SendNotifyMessage
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of FindShellTrayWindow
    • Modifies system certificate store
    PID:1416
  • C:\Program Files\Internet Explorer\iexplore.exe
    "C:\Program Files\Internet Explorer\iexplore.exe"
    1⤵
    • Checks whether UAC is enabled
    • Modifies Internet Explorer settings
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of WriteProcessMemory
    • Modifies system certificate store
    PID:1676
    • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
      "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:1676 CREDAT:275457 /prefetch:2
      2⤵
      • Checks whether UAC is enabled
      • Modifies Internet Explorer settings
      • Suspicious use of SetWindowsHookEx
      • Modifies system certificate store
      PID:288
    • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V0A8Y66O\processhacker-2.39-setup.exe
      "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V0A8Y66O\processhacker-2.39-setup.exe"
      2⤵
      • Executes dropped EXE
      • Loads dropped DLL
      • Suspicious use of WriteProcessMemory
      PID:2252
      • C:\Users\Admin\AppData\Local\Temp\is-KO613.tmp\processhacker-2.39-setup.tmp
        "C:\Users\Admin\AppData\Local\Temp\is-KO613.tmp\processhacker-2.39-setup.tmp" /SL5="$701D0,1874675,150016,C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\V0A8Y66O\processhacker-2.39-setup.exe"
        3⤵
        • Executes dropped EXE
        • Suspicious behavior: EnumeratesProcesses
        • Loads dropped DLL
        • Drops file in Program Files directory
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of WriteProcessMemory
        PID:2272
        • C:\Program Files\Process Hacker 2\ProcessHacker.exe
          "C:\Program Files\Process Hacker 2\ProcessHacker.exe"
          4⤵
          • Suspicious use of AdjustPrivilegeToken
          • Executes dropped EXE
          • Modifies service
          • Checks processor information in registry
          • Suspicious behavior: EnumeratesProcesses
          • Suspicious use of SendNotifyMessage
          • Suspicious behavior: GetForegroundWindowSpam
          • Loads dropped DLL
          • Suspicious use of FindShellTrayWindow
          PID:2340

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/288-15-0x0000000008A10000-0x0000000008A25000-memory.dmp

    Filesize

    84KB

    Download

  • memory/288-14-0x0000000009B30000-0x0000000009B32000-memory.dmp

    Filesize

    8KB

    Download