Analysis

  • max time kernel
    13s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10
  • submitted
    24/06/2020, 14:58

General

  • Target
    6de39de59c8cb978cdceeafae5d1152d.exe
  • Size 266KB
  • Sample200624-5m8nas4n2e
  • SHA256 16de0aa2d02fae6460bb173c9104df4fa758343ab226aea79a3910dce19fa58e
  • MD5 SHA1 SHA512
Score
5/10

Malware Config

Signatures

  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious use of WriteProcessMemory 142 IoCs
  • Suspicious behavior: MapViewOfSection 51 IoCs
  • Suspicious use of SetThreadContext 27 IoCs
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious behavior: EnumeratesProcesses 3415 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:2988
    • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
      "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetThreadContext
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious behavior: EnumeratesProcesses
      PID:3588
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:3800
      • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
        "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious use of AdjustPrivilegeToken
        PID:4004
        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
          4⤵
            PID:3820
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
              PID:3968
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              4⤵
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:3804
            • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
              "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
              4⤵
              • Suspicious use of WriteProcessMemory
              • Suspicious behavior: MapViewOfSection
              • Suspicious use of SetThreadContext
              • Suspicious use of AdjustPrivilegeToken
              PID:68
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:3472
              • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
                "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
                5⤵
                • Suspicious use of WriteProcessMemory
                • Suspicious behavior: MapViewOfSection
                • Suspicious use of SetThreadContext
                • Suspicious use of AdjustPrivilegeToken
                PID:3884
                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                  6⤵
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:2556
                • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
                  "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
                  6⤵
                  • Suspicious use of WriteProcessMemory
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetThreadContext
                  • Suspicious use of AdjustPrivilegeToken
                  PID:4024
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    7⤵
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:1936
                  • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
                    "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
                    7⤵
                    • Suspicious use of WriteProcessMemory
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetThreadContext
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2840
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      8⤵
                        PID:3720
                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                        8⤵
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3736
                      • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
                        "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
                        8⤵
                        • Suspicious use of WriteProcessMemory
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetThreadContext
                        • Suspicious use of AdjustPrivilegeToken
                        PID:556
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          9⤵
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:800
                        • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
                          "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
                          9⤵
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetThreadContext
                          • Suspicious use of AdjustPrivilegeToken
                          PID:376
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            10⤵
                              PID:1164
                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                              10⤵
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:1208
                            • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
                              "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
                              10⤵
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of SetThreadContext
                              • Suspicious use of AdjustPrivilegeToken
                              PID:3808
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                11⤵
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                PID:3588
                              • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
                                "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
                                11⤵
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of SetThreadContext
                                • Suspicious use of AdjustPrivilegeToken
                                PID:1656
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  12⤵
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:3840
                                • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
                                  "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
                                  12⤵
                                  • Suspicious behavior: MapViewOfSection
                                  • Suspicious use of SetThreadContext
                                  • Suspicious use of AdjustPrivilegeToken
                                  PID:2456
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    13⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:2696
                                  • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
                                    "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
                                    13⤵
                                    • Suspicious behavior: MapViewOfSection
                                    • Suspicious use of SetThreadContext
                                    • Suspicious use of AdjustPrivilegeToken
                                    PID:3000
                                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                      14⤵
                                      • Suspicious behavior: MapViewOfSection
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:2576
                                    • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
                                      "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
                                      14⤵
                                      • Suspicious behavior: MapViewOfSection
                                      • Suspicious use of SetThreadContext
                                      • Suspicious use of AdjustPrivilegeToken
                                      PID:1004
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        15⤵
                                          PID:2896
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          15⤵
                                            PID:2184
                                          • C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe
                                            "C:\Users\Admin\AppData\Local\Temp\6de39de59c8cb978cdceeafae5d1152d.exe"
                                            15⤵
                                              PID:500
                  • C:\Windows\SysWOW64\cmstp.exe
                    "C:\Windows\SysWOW64\cmstp.exe"
                    2⤵
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of AdjustPrivilegeToken
                    PID:2984
                    • C:\Windows\SysWOW64\cmd.exe
                      /c del "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      3⤵
                        PID:1620
                    • C:\Windows\SysWOW64\chkdsk.exe
                      "C:\Windows\SysWOW64\chkdsk.exe"
                      2⤵
                      • Enumerates system info in registry
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3560
                    • C:\Windows\SysWOW64\wscript.exe
                      "C:\Windows\SysWOW64\wscript.exe"
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1604
                    • C:\Windows\SysWOW64\control.exe
                      "C:\Windows\SysWOW64\control.exe"
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1112
                    • C:\Windows\SysWOW64\msiexec.exe
                      "C:\Windows\SysWOW64\msiexec.exe"
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:1312
                    • C:\Windows\SysWOW64\NETSTAT.EXE
                      "C:\Windows\SysWOW64\NETSTAT.EXE"
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:3660
                    • C:\Windows\SysWOW64\colorcpl.exe
                      "C:\Windows\SysWOW64\colorcpl.exe"
                      2⤵
                      • Suspicious use of AdjustPrivilegeToken
                      PID:2104
                    • C:\Windows\SysWOW64\explorer.exe
                      "C:\Windows\SysWOW64\explorer.exe"
                      2⤵
                        PID:3796
                      • C:\Windows\SysWOW64\chkdsk.exe
                        "C:\Windows\SysWOW64\chkdsk.exe"
                        2⤵
                        • Enumerates system info in registry
                        • Suspicious use of AdjustPrivilegeToken
                        PID:3552
                      • C:\Windows\SysWOW64\control.exe
                        "C:\Windows\SysWOW64\control.exe"
                        2⤵
                          PID:2980
                        • C:\Windows\SysWOW64\cmd.exe
                          "C:\Windows\SysWOW64\cmd.exe"
                          2⤵
                            PID:412

                        Network

                              MITRE ATT&CK Enterprise v6

                              Replay Monitor

                              Loading Replay Monitor...

                              Downloads

                              memory/1112-43-0x00000000013E0000-0x0000000001400000-memory.dmp

                              memory/1112-44-0x00000000013E0000-0x0000000001400000-memory.dmp

                              memory/1312-47-0x00000000003C0000-0x00000000003D2000-memory.dmp

                              memory/1312-48-0x00000000003C0000-0x00000000003D2000-memory.dmp

                              memory/1604-37-0x0000000001300000-0x0000000001327000-memory.dmp

                              memory/1604-36-0x0000000001300000-0x0000000001327000-memory.dmp

                              memory/2104-62-0x0000000000010000-0x0000000000029000-memory.dmp

                              memory/2104-59-0x0000000000010000-0x0000000000029000-memory.dmp

                              memory/2984-27-0x00000000003F0000-0x0000000000406000-memory.dmp

                              memory/2984-26-0x00000000003F0000-0x0000000000406000-memory.dmp

                              memory/2988-41-0x0000000009D60000-0x0000000009ECE000-memory.dmp

                              memory/2988-55-0x000000000A020000-0x000000000A11A000-memory.dmp

                              memory/2988-14-0x0000000007E80000-0x0000000007FF1000-memory.dmp

                              memory/2988-24-0x0000000008380000-0x0000000008462000-memory.dmp

                              memory/2988-69-0x000000000A120000-0x000000000A29C000-memory.dmp

                              memory/2988-49-0x0000000009ED0000-0x000000000A01F000-memory.dmp

                              memory/3552-66-0x0000000000D40000-0x0000000000D4A000-memory.dmp

                              memory/3552-67-0x0000000000D40000-0x0000000000D4A000-memory.dmp

                              memory/3560-31-0x0000000000D40000-0x0000000000D4A000-memory.dmp

                              memory/3560-30-0x0000000000D40000-0x0000000000D4A000-memory.dmp

                              memory/3660-54-0x0000000001210000-0x000000000121B000-memory.dmp

                              memory/3660-53-0x0000000001210000-0x000000000121B000-memory.dmp

                              memory/3796-64-0x0000000000E00000-0x000000000123F000-memory.dmp

                              memory/3796-72-0x0000000000E00000-0x000000000123F000-memory.dmp

                              memory/3800-0-0x0000000000400000-0x000000000042D000-memory.dmp