922d69b91fbe84aaf3f6fae8eb416ce48f8106e6cb5ec60846409beb029b235b

General

Target

CV.exe
Size

452KB
MD5

da433bf4f7ae613fa6a3e3b52f006a6b
SHA1

2d0273829977db284382be3e6735ac9993ea91a1
SHA256

922d69b91fbe84aaf3f6fae8eb416ce48f8106e6cb5ec60846409beb029b235b
SHA512

2d64e923cb6809c70873c8d8801148fcab302876eb81978746a1311028e75197701c766ef0ea76334145a58a2b4c79e1f9388a4c35cc9b8fa82df53396f38e51

Score

7^/10

Malware Config

Signatures

Suspicious use of WriteProcessMemory 15 IoCs

description	pid	Process	procid_target
PID 1164 wrote to memory of 1508	1164	CV.exe	24
PID 1164 wrote to memory of 1508	1164	CV.exe	24
PID 1164 wrote to memory of 1508	1164	CV.exe	24
PID 1164 wrote to memory of 1508	1164	CV.exe	24
PID 1164 wrote to memory of 1508	1164	CV.exe	24
PID 1164 wrote to memory of 1508	1164	CV.exe	24
PID 1164 wrote to memory of 1508	1164	CV.exe	24
PID 1336 wrote to memory of 660	1336	Explorer.EXE	26
PID 1336 wrote to memory of 660	1336	Explorer.EXE	26
PID 1336 wrote to memory of 660	1336	Explorer.EXE	26
PID 1336 wrote to memory of 660	1336	Explorer.EXE	26
PID 660 wrote to memory of 764	660	cmmon32.exe	27
PID 660 wrote to memory of 764	660	cmmon32.exe	27
PID 660 wrote to memory of 764	660	cmmon32.exe	27
PID 660 wrote to memory of 764	660	cmmon32.exe	27

Suspicious behavior: EnumeratesProcesses 24 IoCs

pid	Process
1508	CV.exe
1508	CV.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe
660	cmmon32.exe

Suspicious behavior: MapViewOfSection 5 IoCs

pid	Process
1508	CV.exe
1508	CV.exe
1508	CV.exe
660	cmmon32.exe
660	cmmon32.exe

Suspicious use of SendNotifyMessage 4 IoCs

pid	Process
1336	Explorer.EXE
1336	Explorer.EXE
1336	Explorer.EXE
1336	Explorer.EXE

Suspicious use of SetThreadContext 3 IoCs

description	pid	Process	procid_target
PID 1164 set thread context of 1508	1164	CV.exe	24
PID 1508 set thread context of 1336	1508	CV.exe	20
PID 660 set thread context of 1336	660	cmmon32.exe	20

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	1508	CV.exe
Token: SeDebugPrivilege	660	cmmon32.exe

Deletes itself 1 IoCs

pid	Process
764	cmd.exe

Suspicious use of FindShellTrayWindow 5 IoCs

pid	Process
1336	Explorer.EXE
1336	Explorer.EXE
1336	Explorer.EXE
1336	Explorer.EXE
1336	Explorer.EXE

Checks whether UAC is enabled 1 TTPs 1 IoCs

evasion trojan

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System\EnableLUA	Explorer.EXE

C:\Windows\Explorer.EXE
C:\Windows\Explorer.EXE
1⤵
- Suspicious use of WriteProcessMemory
- Suspicious use of SendNotifyMessage
- Suspicious use of FindShellTrayWindow
- Checks whether UAC is enabled
PID:1336
- C:\Users\Admin\AppData\Local\Temp\CV.exe
  "C:\Users\Admin\AppData\Local\Temp\CV.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious use of SetThreadContext
  PID:1164
- - C:\Users\Admin\AppData\Local\Temp\CV.exe
    "{path}"
    3⤵
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious behavior: MapViewOfSection
    - Suspicious use of SetThreadContext
    - Suspicious use of AdjustPrivilegeToken
    PID:1508
- C:\Windows\SysWOW64\autochk.exe
  "C:\Windows\SysWOW64\autochk.exe"
  2⤵
  PID:1632
- C:\Windows\SysWOW64\cmmon32.exe
  "C:\Windows\SysWOW64\cmmon32.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of SetThreadContext
  - Suspicious use of AdjustPrivilegeToken
  PID:660
- - C:\Windows\SysWOW64\cmd.exe
    /c del "C:\Users\Admin\AppData\Local\Temp\CV.exe"
    3⤵
    - Deletes itself
    PID:764

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Credential Access

Discovery

System Information Discovery

1

T1082

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/660-5-0x0000000000630000-0x000000000063D000-memory.dmp

Filesize
52KB

Download
memory/660-7-0x0000000002F80000-0x00000000030E1000-memory.dmp

Filesize
1.4MB

Download
memory/1508-2-0x0000000000400000-0x000000000042A000-memory.dmp

Filesize
168KB

Download

Analysis

Sharing