Analysis
- max time kernel
150s - max time network
67s - platform
windows7_x64 - resource
win7 - submitted
24/06/2020, 13:14
Static task
static1
Behavioral task
behavioral1
Sample
copy #24445.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
copy #24445.exe
Resource
win10v200430
windows10_x64
0 signatures
0 seconds
General
- Target copy #24445.exe
- Size 335KB
- Sample200624-zedma36dgx
- SHA256 8f684309eb4b620c8b81b30aa2d1b8f09d3f8e3dd69dadfb69f7b6db8e1bb1e3
- MD5 6230f83f0a3f26287897f759daf0f00f
- SHA1 e00876c2a2278aee3aaa73244ade6b239e3d5fff
- SHA512 18480936dc9e57720b19991bebc5f53ac0107a808ca873c3d15c1b109a029e65118a4f23efc9c3ef58a26806bf49f922bbe71e48943054f2aa488b9e1bddc18e
- MD5 SHA1 SHA512
Malware Config
Signatures
- Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE - Suspicious use of WriteProcessMemory 15 IoCs
description pid Process procid_target PID 1144 wrote to memory of 1260 1144 copy #24445.exe 24 PID 1144 wrote to memory of 1260 1144 copy #24445.exe 24 PID 1144 wrote to memory of 1260 1144 copy #24445.exe 24 PID 1144 wrote to memory of 1260 1144 copy #24445.exe 24 PID 1144 wrote to memory of 1260 1144 copy #24445.exe 24 PID 1144 wrote to memory of 1260 1144 copy #24445.exe 24 PID 1144 wrote to memory of 1260 1144 copy #24445.exe 24 PID 1264 wrote to memory of 1588 1264 Explorer.EXE 25 PID 1264 wrote to memory of 1588 1264 Explorer.EXE 25 PID 1264 wrote to memory of 1588 1264 Explorer.EXE 25 PID 1264 wrote to memory of 1588 1264 Explorer.EXE 25 PID 1588 wrote to memory of 1060 1588 netsh.exe 26 PID 1588 wrote to memory of 1060 1588 netsh.exe 26 PID 1588 wrote to memory of 1060 1588 netsh.exe 26 PID 1588 wrote to memory of 1060 1588 netsh.exe 26 - Suspicious behavior: EnumeratesProcesses 24 IoCs
pid Process 1260 copy #24445.exe 1260 copy #24445.exe 1260 copy #24445.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe 1588 netsh.exe - Deletes itself 1 IoCs
pid Process 1060 cmd.exe - Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
description ioc Process Key value queried \REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA Explorer.EXE - Suspicious use of SetThreadContext 4 IoCs
description pid Process procid_target PID 1144 set thread context of 1260 1144 copy #24445.exe 24 PID 1260 set thread context of 1264 1260 copy #24445.exe 20 PID 1260 set thread context of 1264 1260 copy #24445.exe 20 PID 1588 set thread context of 1264 1588 netsh.exe 20 - Suspicious use of AdjustPrivilegeToken 2 IoCs
description pid Process Token: SeDebugPrivilege 1260 copy #24445.exe Token: SeDebugPrivilege 1588 netsh.exe - Suspicious behavior: MapViewOfSection 6 IoCs
pid Process 1260 copy #24445.exe 1260 copy #24445.exe 1260 copy #24445.exe 1260 copy #24445.exe 1588 netsh.exe 1588 netsh.exe
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of SendNotifyMessage
- Suspicious use of WriteProcessMemory
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\copy #24445.exe"C:\Users\Admin\AppData\Local\Temp\copy #24445.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SetThreadContext
PID:1144 -
C:\Users\Admin\AppData\Local\Temp\copy #24445.exe"{path}"3⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1260
-
-
-
C:\Windows\SysWOW64\netsh.exe"C:\Windows\SysWOW64\netsh.exe"2⤵
- Suspicious use of WriteProcessMemory
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: MapViewOfSection
PID:1588 -
C:\Windows\SysWOW64\cmd.exe/c del "C:\Users\Admin\AppData\Local\Temp\copy #24445.exe"3⤵
- Deletes itself
PID:1060
-
-