Overview

overview

10

Static

static

冠状病æ...in.exe

windows7_x64

10

冠状病æ...in.exe

windows10_x64

10

Analysis

  • max time kernel
    151s
  • platform
    windows7_x64
  • resource
    win7v200217
  • submitted
    19-03-2020 03:26

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    冠状病毒.exe.bin.exe

  • Size

    16KB

  • MD5

    674805b536e872a7b6412711699ee44f

  • SHA1

    8926009b3d9c76ec9f30a42ac149621b5a722a2a

  • SHA256

    adde95e8813ca27d88923bd091ca2166553a7b904173ef7a2c04bb3ddf8b14a9

  • SHA512

    f35c0c365c12a4cd1a7a4c78f0b85dee278f256322f1be87d998db24b9f985ca7cba44ef4c4c2846c0fac0cba293b39d62996ea2e088c770d3ce70dabd18f40b

Score
10/10
persistenceevasiontrojanspyware

Malware Config

Signatures

  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Windows security modification 2 TTPs 2 IoCs
    evasiontrojan
  • Drops file in Program Files directory 2344 IoCs
  • Modifies registry key 1 TTPs 1 IoCs
  • Drops file in Windows directory 21615 IoCs
  • Modifies Installed Components in the registry 2 TTPs 23 IoCs
    persistence
  • Adds autorun key to be loaded by Explorer.exe on startup 2 TTPs 1 IoCs
    persistence
  • Modifies registry class 24273 IoCs
  • Drops desktop.ini file(s) 51 IoCs
  • Sets file execution options in registry 2 TTPs 8 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 20 IoCs
  • Modifies Internet Explorer settings 1 TTPs 1234 IoCs
    adwarespyware
  • Adds Run entry to start application 2 TTPs 6 IoCs
    persistence
  • Drops file in Drivers directory 9 IoCs
  • Drops file in System32 directory 4550 IoCs
  • Modifies system certificate store 2 TTPs 20 IoCs
    evasionspywaretrojan
  • Modifies system executable filetype association 2 TTPs 45 IoCs
    persistence
  • System policy modification 1 TTPs 9 IoCs
    evasion
  • Modifies Winlogon 2 TTPs 10 IoCs
    persistence

Processes

  • C:\Users\Admin\AppData\Local\Temp\冠状病毒.exe.bin.exe
    "C:\Users\Admin\AppData\Local\Temp\冠状病毒.exe.bin.exe"
    1⤵
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1868
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c rd/s /q c:\
      2⤵
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Drops desktop.ini file(s)
      • Drops file in Drivers directory
      • Drops file in System32 directory
      PID:1884
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c REG DELETE HKLM\Software\ /f
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:1892
      • C:\Windows\SysWOW64\reg.exe
        REG DELETE HKLM\Software\ /f
        3⤵
        • Windows security modification
        • Modifies registry key
        • Modifies Installed Components in the registry
        • Adds autorun key to be loaded by Explorer.exe on startup
        • Modifies registry class
        • Sets file execution options in registry
        • Modifies Internet Explorer settings
        • Adds Run entry to start application
        • Modifies system certificate store
        • Modifies system executable filetype association
        • System policy modification
        • Modifies Winlogon
        PID:1992
    • C:\Windows\SysWOW64\cmd.exe
      cmd /c rd/s /q d:\
      2⤵
        PID:1912
      • C:\Windows\SysWOW64\cmd.exe
        cmd /c rd/s /q d:\
        2⤵
          PID:1936

      Network

      MITRE ATT&CK Matrix ATT&CK v6

      Initial Access

      Execution

      Persistence

      Registry Run Keys / Startup Folder

      4
      T1060

      Change Default File Association

      1
      T1042

      Winlogon Helper DLL

      1
      T1004

      Privilege Escalation

      Defense Evasion

      Disabling Security Tools

      1
      T1089

      Modify Registry

      11
      T1112

      Install Root Certificate

      1
      T1130

      Credential Access

      Discovery

      Lateral Movement

      Collection

      Exfiltration

      Command and Control

      Impact

      Replay Monitor

      Loading Replay Monitor...

      Downloads