b6fe251f63967620aa825a84bec39adea438c1c8e29193f236ffc22bda75523b

Analysis

max time kernel
147s
max time network
156s
platform
windows7_x64
resource
win7v200430
submitted
24/06/2020, 15:08

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
CC_AUTH.EXE
Size 428KB
Sample200624-2tz52ebnf2
SHA256 b6fe251f63967620aa825a84bec39adea438c1c8e29193f236ffc22bda75523b
MD5 b7fcf8c721a3540fbddc0184a7ef346f
SHA1 c884956febcc0c6cffb7c45bb47993fb665dea93
SHA512 efd06206b6dac000ce130547c15e02cbd0e07aa7d0af7b727818730e65d5f6625bf7178b5b3f2016b5b5200129f73c881d7014afe676fdcca4afb3b476a4722f
MD5 SHA1 SHA512

Score

8^/10

persistence

Malware Config

Signatures

Suspicious use of WriteProcessMemory 18 IoCs

description	pid	Process	procid_target
PID 1520 wrote to memory of 1824	1520	CC_AUTH.EXE	27
PID 1520 wrote to memory of 1824	1520	CC_AUTH.EXE	27
PID 1520 wrote to memory of 1824	1520	CC_AUTH.EXE	27
PID 1520 wrote to memory of 1824	1520	CC_AUTH.EXE	27
PID 1520 wrote to memory of 1844	1520	CC_AUTH.EXE	29
PID 1520 wrote to memory of 1844	1520	CC_AUTH.EXE	29
PID 1520 wrote to memory of 1844	1520	CC_AUTH.EXE	29
PID 1520 wrote to memory of 1844	1520	CC_AUTH.EXE	29
PID 1844 wrote to memory of 784	1844	images.exe	31
PID 1844 wrote to memory of 784	1844	images.exe	31
PID 1844 wrote to memory of 784	1844	images.exe	31
PID 1844 wrote to memory of 784	1844	images.exe	31
PID 1844 wrote to memory of 564	1844	images.exe	33
PID 1844 wrote to memory of 564	1844	images.exe	33
PID 1844 wrote to memory of 564	1844	images.exe	33
PID 1844 wrote to memory of 564	1844	images.exe	33
PID 1844 wrote to memory of 564	1844	images.exe	33
PID 1844 wrote to memory of 564	1844	images.exe	33

Loads dropped DLL 1 IoCs

pid	Process
1520	CC_AUTH.EXE

Executes dropped EXE 1 IoCs

pid	Process
1844	images.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1824	powershell.exe
Token: SeDebugPrivilege	784	powershell.exe

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
1824	powershell.exe
1824	powershell.exe
784	powershell.exe
784	powershell.exe

Adds Run entry to start application 2 TTPs 1 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe"	CC_AUTH.EXE

C:\Users\Admin\AppData\Local\Temp\CC_AUTH.EXE
"C:\Users\Admin\AppData\Local\Temp\CC_AUTH.EXE"
1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Adds Run entry to start application
PID:1520
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  powershell Add-MpPreference -ExclusionPath C:\
  2⤵
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious behavior: EnumeratesProcesses
  PID:1824
- C:\ProgramData\images.exe
  "C:\ProgramData\images.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Executes dropped EXE
  PID:1844
- - C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
    powershell Add-MpPreference -ExclusionPath C:\
    3⤵
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious behavior: EnumeratesProcesses
    PID:784
- - C:\Windows\SysWOW64\cmd.exe
    "C:\Windows\System32\cmd.exe"
    3⤵
    PID:564

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/564-14-0x0000000000130000-0x0000000000131000-memory.dmp

Download

memory/1520-0-0x0000000001E90000-0x0000000001FE3000-memory.dmp

Download

memory/1844-7-0x0000000001E30000-0x0000000001F83000-memory.dmp

Download