Overview

overview

7

Static

static

LIST OF PR...at.exe

windows7_x64

7

LIST OF PR...at.exe

windows10_x64

3

Analysis

  • max time kernel
    150s
  • max time network
    92s
  • platform
    windows7_x64
  • resource
    win7
  • submitted
    30-06-2020 05:56

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    LIST OF PRODUCTS AND SPECIFICATIONS.bat.exe

  • Size

    347KB

  • MD5

    1d2585eb104895bd6a4059cee636cee7

  • SHA1

    79437779f16915a20a5a38a768242427eed08401

  • SHA256

    1bf9db8285719827160844a6a51292c30346c3099a4753c92177cba4e59b2404

  • SHA512

    b5733f78528110f8f04c0df961f38a974d04a888a9b920ad48758954fadfa5a43d46106537dbfa9877acd25d58631d9c1cd4ffac709f13f7ad6ea43869b9d201

Score
7/10
evasiontrojan

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious behavior: MapViewOfSection 6 IoCs
  • Suspicious use of WriteProcessMemory 15 IoCs
  • Suspicious use of SetThreadContext 4 IoCs
  • Suspicious behavior: EnumeratesProcesses 24 IoCs
  • Deletes itself 1 IoCs
  • Suspicious use of FindShellTrayWindow 5 IoCs
  • Suspicious use of SendNotifyMessage 4 IoCs
  • Checks whether UAC is enabled 1 TTPs 1 IoCs
    evasiontrojan

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of WriteProcessMemory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Checks whether UAC is enabled
    PID:1276
    • C:\Users\Admin\AppData\Local\Temp\LIST OF PRODUCTS AND SPECIFICATIONS.bat.exe
      "C:\Users\Admin\AppData\Local\Temp\LIST OF PRODUCTS AND SPECIFICATIONS.bat.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      • Suspicious use of SetThreadContext
      PID:896
      • C:\Users\Admin\AppData\Local\Temp\LIST OF PRODUCTS AND SPECIFICATIONS.bat.exe
        "{path}"
        3⤵
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of SetThreadContext
        • Suspicious behavior: EnumeratesProcesses
        PID:1636
    • C:\Windows\SysWOW64\autofmt.exe
      "C:\Windows\SysWOW64\autofmt.exe"
      2⤵
        PID:1516
      • C:\Windows\SysWOW64\autofmt.exe
        "C:\Windows\SysWOW64\autofmt.exe"
        2⤵
          PID:1504
        • C:\Windows\SysWOW64\autofmt.exe
          "C:\Windows\SysWOW64\autofmt.exe"
          2⤵
            PID:1664
          • C:\Windows\SysWOW64\cmd.exe
            "C:\Windows\SysWOW64\cmd.exe"
            2⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of WriteProcessMemory
            • Suspicious use of SetThreadContext
            • Suspicious behavior: EnumeratesProcesses
            PID:1692
            • C:\Windows\SysWOW64\cmd.exe
              /c del "C:\Users\Admin\AppData\Local\Temp\LIST OF PRODUCTS AND SPECIFICATIONS.bat.exe"
              3⤵
              • Deletes itself
              PID:1864

        Network

        MITRE ATT&CK Matrix ATT&CK v6

        Initial Access

        Execution

        Persistence

        Privilege Escalation

        Defense Evasion

        Credential Access

        Discovery

        System Information Discovery

        1
        T1082

        Lateral Movement

        Collection

        Exfiltration

        Command and Control

        Impact

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • memory/896-1-0x0000000000000000-0x0000000000000000-disk.dmp
          Download
        • memory/1636-2-0x0000000000400000-0x000000000042D000-memory.dmp
          Filesize

          180KB

          Download
        • memory/1636-3-0x000000000041E2F0-mapping.dmp
          Download
        • memory/1692-4-0x0000000000000000-mapping.dmp
          Download
        • memory/1692-5-0x000000004A480000-0x000000004A4CC000-memory.dmp
          Filesize

          304KB

          Download
        • memory/1692-7-0x0000000003210000-0x0000000003399000-memory.dmp
          Filesize

          1.5MB

          Download
        • memory/1864-6-0x0000000000000000-mapping.dmp
          Download