Analysis
-
max time kernel
113s -
max time network
63s -
platform
windows7_x64 -
resource
win7 -
submitted
13-07-2020 11:03
Static task
static1
Behavioral task
behavioral1
Sample
PO_ 74317-1372020.bin.exe
Resource
win7
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
PO_ 74317-1372020.bin.exe
Resource
win10v200430
0 signatures
0 seconds
General
-
Target
PO_ 74317-1372020.bin.exe
-
Size
1.1MB
-
MD5
80e69b644da84346012b2b8e0b177d7d
-
SHA1
1e379290040a1dab313a1760f5eb496d0d72b4a2
-
SHA256
446f16b0c437e7be8d51c9365276bcee5cd8709f0a1bbb95fad2969c21e2db54
-
SHA512
d1acf251288afbeb7a086350ae0d5b6e5f3249a559f419f73bdb98cd3794fcdf0c735b105966a79315215f303608008048602a41b5cde3d2b6d8252ccbd1f7a9
Score
8/10
Malware Config
Signatures
-
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
PO_ 74317-1372020.bin.exewindow.exedescription pid process Token: SeDebugPrivilege 1312 PO_ 74317-1372020.bin.exe Token: SeDebugPrivilege 1836 window.exe -
Suspicious behavior: EnumeratesProcesses 6 IoCs
Processes:
PO_ 74317-1372020.bin.exewindow.exepid process 1312 PO_ 74317-1372020.bin.exe 1312 PO_ 74317-1372020.bin.exe 1312 PO_ 74317-1372020.bin.exe 1836 window.exe 1836 window.exe 1836 window.exe -
Suspicious use of WriteProcessMemory 23 IoCs
Processes:
PO_ 74317-1372020.bin.execmd.exewindow.exedescription pid process target process PID 1312 wrote to memory of 368 1312 PO_ 74317-1372020.bin.exe cmd.exe PID 1312 wrote to memory of 368 1312 PO_ 74317-1372020.bin.exe cmd.exe PID 1312 wrote to memory of 368 1312 PO_ 74317-1372020.bin.exe cmd.exe PID 1312 wrote to memory of 368 1312 PO_ 74317-1372020.bin.exe cmd.exe PID 368 wrote to memory of 1068 368 cmd.exe reg.exe PID 368 wrote to memory of 1068 368 cmd.exe reg.exe PID 368 wrote to memory of 1068 368 cmd.exe reg.exe PID 368 wrote to memory of 1068 368 cmd.exe reg.exe PID 1312 wrote to memory of 1836 1312 PO_ 74317-1372020.bin.exe window.exe PID 1312 wrote to memory of 1836 1312 PO_ 74317-1372020.bin.exe window.exe PID 1312 wrote to memory of 1836 1312 PO_ 74317-1372020.bin.exe window.exe PID 1312 wrote to memory of 1836 1312 PO_ 74317-1372020.bin.exe window.exe PID 1836 wrote to memory of 2004 1836 window.exe InstallUtil.exe PID 1836 wrote to memory of 2004 1836 window.exe InstallUtil.exe PID 1836 wrote to memory of 2004 1836 window.exe InstallUtil.exe PID 1836 wrote to memory of 2004 1836 window.exe InstallUtil.exe PID 1836 wrote to memory of 2004 1836 window.exe InstallUtil.exe PID 1836 wrote to memory of 2004 1836 window.exe InstallUtil.exe PID 1836 wrote to memory of 2004 1836 window.exe InstallUtil.exe PID 1836 wrote to memory of 2004 1836 window.exe InstallUtil.exe PID 1836 wrote to memory of 2004 1836 window.exe InstallUtil.exe PID 1836 wrote to memory of 2004 1836 window.exe InstallUtil.exe PID 1836 wrote to memory of 2004 1836 window.exe InstallUtil.exe -
Loads dropped DLL 2 IoCs
Processes:
PO_ 74317-1372020.bin.exewindow.exepid process 1312 PO_ 74317-1372020.bin.exe 1836 window.exe -
Executes dropped EXE 2 IoCs
Processes:
window.exeInstallUtil.exepid process 1836 window.exe 2004 InstallUtil.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
window.exedescription pid process target process PID 1836 set thread context of 2004 1836 window.exe InstallUtil.exe -
Adds Run entry to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\window = "C:\\Windows\\system32\\pcalua.exe -a C:\\Users\\Admin\\AppData\\Roaming\\Microsoft\\Windows\\Templates\\window.exe" reg.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\PO_ 74317-1372020.bin.exe"C:\Users\Admin\AppData\Local\Temp\PO_ 74317-1372020.bin.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c REG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v window /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\window.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run /f /v window /t REG_SZ /d C:\Windows\system32\pcalua.exe" -a C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\window.exe"3⤵
- Adds Run entry to start application
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\window.exe"C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\window.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
- Loads dropped DLL
- Executes dropped EXE
- Suspicious use of SetThreadContext
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\window.exe
-
C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\window.exe
-
\Users\Admin\AppData\Local\Temp\InstallUtil.exe
-
\Users\Admin\AppData\Roaming\Microsoft\Windows\Templates\window.exe
-
memory/368-3-0x0000000000000000-mapping.dmp
-
memory/1068-4-0x0000000000000000-mapping.dmp
-
memory/1312-1-0x0000000000000000-0x0000000000000000-disk.dmp
-
memory/1836-6-0x0000000000000000-mapping.dmp
-
memory/2004-18-0x000000000040104C-mapping.dmp