Analysis
- max time kernel
63s - max time network
68s - platform
windows10_x64 - resource
win10v200430 - submitted
24/06/2020, 14:56
Static task
static1
Behavioral task
behavioral1
Sample
a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe
- Size 6.1MB
- Sample200624-jth8tfj49x
- SHA256 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e
- MD5 1d15effd0901fc246188b1e24b74109e
- SHA1 9c9e209014e9528421312fcd8b062ce65c46ca96
- SHA512 962d9f5108a8a3297efd05bb41cb34272b76bc2cf3e18b8bb89eeca492fe58b5aac85aa8ec090549b7dc9ecbcf3835db74f49acd2ae2cd1867e9473079a348b4
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Drops startup file 2 IoCs
description ioc Process File opened for modification C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs cmd.exe - Adds Run entry to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-1231583446-2617009595-2137880041-1000\Software\Microsoft\Windows\CurrentVersion\Run\Microsoft OneDrive = "C:\\Users\\Admin\\AppData\\Local\\Chrome\\StikyNot.exe" a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe - Drops file in Windows directory 2 IoCs
description ioc Process File opened for modification \??\c:\windows\system\explorer.exe a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe File opened for modification \??\c:\windows\system\explorer.exe explorer.exe - Suspicious use of SetWindowsHookEx 6 IoCs
pid Process 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 3696 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 3696 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 304 explorer.exe 304 explorer.exe - Suspicious use of WriteProcessMemory 80 IoCs
description pid Process procid_target PID 428 wrote to memory of 588 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 66 PID 428 wrote to memory of 588 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 66 PID 428 wrote to memory of 588 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 66 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 428 wrote to memory of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 856 wrote to memory of 3696 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 75 PID 856 wrote to memory of 3696 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 75 PID 856 wrote to memory of 3696 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 75 PID 856 wrote to memory of 3696 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 75 PID 856 wrote to memory of 3696 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 75 PID 856 wrote to memory of 3696 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 75 PID 856 wrote to memory of 3696 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 75 PID 856 wrote to memory of 3696 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 75 PID 856 wrote to memory of 4028 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 76 PID 856 wrote to memory of 4028 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 76 PID 856 wrote to memory of 4028 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 76 PID 856 wrote to memory of 4028 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 76 PID 856 wrote to memory of 4028 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 76 PID 3696 wrote to memory of 304 3696 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 77 PID 3696 wrote to memory of 304 3696 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 77 PID 3696 wrote to memory of 304 3696 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 77 PID 304 wrote to memory of 3964 304 explorer.exe 78 PID 304 wrote to memory of 3964 304 explorer.exe 78 PID 304 wrote to memory of 3964 304 explorer.exe 78 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 PID 304 wrote to memory of 3000 304 explorer.exe 80 - Suspicious behavior: EnumeratesProcesses 6 IoCs
pid Process 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 3696 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 3696 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 304 explorer.exe 304 explorer.exe - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 428 set thread context of 856 428 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 68 PID 856 set thread context of 3696 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 75 PID 856 set thread context of 4028 856 a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe 76 PID 304 set thread context of 3000 304 explorer.exe 80 - Executes dropped EXE 2 IoCs
pid Process 304 explorer.exe 3000 explorer.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe"C:\Users\Admin\AppData\Local\Temp\a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe"1⤵
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
PID:428 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "C:\Users\Admin\AppData\Local\Temp\a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"2⤵
- Drops startup file
PID:588
-
-
C:\Users\Admin\AppData\Local\Temp\a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exeC:\Users\Admin\AppData\Local\Temp\a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe2⤵
- Adds Run entry to start application
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:856 -
C:\Users\Admin\AppData\Local\Temp\a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exeC:\Users\Admin\AppData\Local\Temp\a42c5d5a41295e29673e865a370cf660dda411aaa20f29b2586342cd0a658a3e.exe3⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
PID:3696 -
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe4⤵
- Drops file in Windows directory
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Executes dropped EXE
PID:304 -
C:\Windows\SysWOW64\cmd.exeC:\Windows\system32\cmd.exe /c echo on error resume next:CreateObject("WScript.Shell").Run "c:\windows\system\explorer.exe",1: >"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\x.vbs"5⤵
- Drops startup file
PID:3964
-
-
\??\c:\windows\system\explorer.exec:\windows\system\explorer.exe5⤵
- Executes dropped EXE
PID:3000
-
-
-
-
C:\Windows\SysWOW64\diskperf.exe"C:\Windows\SysWOW64\diskperf.exe"3⤵PID:4028
-
-