Analysis
-
max time kernel
144s -
max time network
154s -
platform
windows7_x64 -
resource
win7v200430 -
submitted
13-07-2020 06:34
Static task
static1
Behavioral task
behavioral1
Sample
1a6014d5372cb9cc90f6fcd84e85a0b5.exe
Resource
win7v200430
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
1a6014d5372cb9cc90f6fcd84e85a0b5.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
-
Target
1a6014d5372cb9cc90f6fcd84e85a0b5.exe
-
Size
1.3MB
-
MD5
1a6014d5372cb9cc90f6fcd84e85a0b5
-
SHA1
d12df5828471f094c7a268c9564ddc7ea19a4540
-
SHA256
419fdd95959d3b4a086ad9009775e08bde4867593bffc22e05e19d89606698f4
-
SHA512
e2afb15977c7f43ba0b82509a3651b9d085ed11bcc0c8113527b001f5df78a1dad0384e157f132e57ce4975da357c08234eb135dbfd7aa2f043935a7a4bf9af0
Score
8/10
Malware Config
Signatures
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes:
1a6014d5372cb9cc90f6fcd84e85a0b5.exeimages.exedescription pid process target process PID 1312 wrote to memory of 1764 1312 1a6014d5372cb9cc90f6fcd84e85a0b5.exe powershell.exe PID 1312 wrote to memory of 1764 1312 1a6014d5372cb9cc90f6fcd84e85a0b5.exe powershell.exe PID 1312 wrote to memory of 1764 1312 1a6014d5372cb9cc90f6fcd84e85a0b5.exe powershell.exe PID 1312 wrote to memory of 1764 1312 1a6014d5372cb9cc90f6fcd84e85a0b5.exe powershell.exe PID 1312 wrote to memory of 1804 1312 1a6014d5372cb9cc90f6fcd84e85a0b5.exe images.exe PID 1312 wrote to memory of 1804 1312 1a6014d5372cb9cc90f6fcd84e85a0b5.exe images.exe PID 1312 wrote to memory of 1804 1312 1a6014d5372cb9cc90f6fcd84e85a0b5.exe images.exe PID 1312 wrote to memory of 1804 1312 1a6014d5372cb9cc90f6fcd84e85a0b5.exe images.exe PID 1804 wrote to memory of 1324 1804 images.exe powershell.exe PID 1804 wrote to memory of 1324 1804 images.exe powershell.exe PID 1804 wrote to memory of 1324 1804 images.exe powershell.exe PID 1804 wrote to memory of 1324 1804 images.exe powershell.exe PID 1804 wrote to memory of 1516 1804 images.exe cmd.exe PID 1804 wrote to memory of 1516 1804 images.exe cmd.exe PID 1804 wrote to memory of 1516 1804 images.exe cmd.exe PID 1804 wrote to memory of 1516 1804 images.exe cmd.exe PID 1804 wrote to memory of 1516 1804 images.exe cmd.exe PID 1804 wrote to memory of 1516 1804 images.exe cmd.exe -
Loads dropped DLL 1 IoCs
Processes:
1a6014d5372cb9cc90f6fcd84e85a0b5.exepid process 1312 1a6014d5372cb9cc90f6fcd84e85a0b5.exe -
Executes dropped EXE 1 IoCs
Processes:
images.exepid process 1804 images.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
powershell.exepowershell.exedescription pid process Token: SeDebugPrivilege 1764 powershell.exe Token: SeDebugPrivilege 1324 powershell.exe -
Suspicious behavior: EnumeratesProcesses 4 IoCs
Processes:
powershell.exepowershell.exepid process 1764 powershell.exe 1764 powershell.exe 1324 powershell.exe 1324 powershell.exe -
Drops startup file 2 IoCs
Processes:
1a6014d5372cb9cc90f6fcd84e85a0b5.exedescription ioc process File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat 1a6014d5372cb9cc90f6fcd84e85a0b5.exe File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\programs.bat:start 1a6014d5372cb9cc90f6fcd84e85a0b5.exe -
NTFS ADS 1 IoCs
Processes:
1a6014d5372cb9cc90f6fcd84e85a0b5.exedescription ioc process File created C:\ProgramData:ApplicationData 1a6014d5372cb9cc90f6fcd84e85a0b5.exe -
Adds Run entry to start application 2 TTPs 1 IoCs
Processes:
1a6014d5372cb9cc90f6fcd84e85a0b5.exedescription ioc process Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run\Images = "C:\\ProgramData\\images.exe" 1a6014d5372cb9cc90f6fcd84e85a0b5.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\1a6014d5372cb9cc90f6fcd84e85a0b5.exe"C:\Users\Admin\AppData\Local\Temp\1a6014d5372cb9cc90f6fcd84e85a0b5.exe"1⤵
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Drops startup file
- NTFS ADS
- Adds Run entry to start application
PID:1312 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1764 -
C:\ProgramData\images.exe"C:\ProgramData\images.exe"2⤵
- Suspicious use of WriteProcessMemory
- Executes dropped EXE
PID:1804 -
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exepowershell Add-MpPreference -ExclusionPath C:\3⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
PID:1324 -
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe"3⤵PID:1516
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\ProgramData
-
C:\ProgramData\images.exe
-
C:\ProgramData\images.exe
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_2f8f6cc7-ae83-4f79-b06e-2b9a49e06c5b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_3f934678-4276-4d7d-9a2b-7ccacecf398b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_670419ca-9b90-4e9d-a6c5-f73b7563d382
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_70ee6646-9493-43f2-b13c-4c957e73327b
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_73feecb3-d79a-4eeb-a81d-9ada485ee6e0
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_9065e065-05e7-4eaa-bb93-1db6da178e99
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a25ca260-f11a-4bfc-8707-3ea8e9792dea
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_a3b7b651-7089-41b5-9155-3fb877609508
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_b7a807a3-f6b6-4397-972a-e9e81988f869
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c3bacd47-4466-4857-8344-29322adf959a
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_c9094d30-b50d-42a4-8f8f-15da9762ace3
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheEntry_e331f9c7-6ec8-40f5-b318-7a4a05eb497d
-
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\CommandAnalysis\PowerShell_AnalysisCacheIndex
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Recent\CustomDestinations\d93f411851d7c929.customDestinations-ms
-
\ProgramData\images.exe
-
memory/1312-0-0x0000000000670000-0x00000000007C3000-memory.dmpFilesize
1.3MB
-
memory/1324-10-0x0000000000000000-mapping.dmp
-
memory/1516-16-0x0000000000000000-mapping.dmp
-
memory/1516-15-0x0000000000170000-0x0000000000171000-memory.dmpFilesize
4KB
-
memory/1516-11-0x0000000000000000-mapping.dmp
-
memory/1764-1-0x0000000000000000-mapping.dmp
-
memory/1804-8-0x0000000000790000-0x00000000008E3000-memory.dmpFilesize
1.3MB
-
memory/1804-3-0x0000000000000000-mapping.dmp