Overview

overview

6

Static

static

LC DRAFT C...es.exe

windows7_x64

6

LC DRAFT C...es.exe

windows10_x64

6

Analysis

  • max time kernel
    151s
  • max time network
    99s
  • platform
    windows7_x64
  • resource
    win7v200722
  • submitted
    25/07/2020, 07:45

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    LC DRAFT COPY_images.exe
  • Size 531KB
  • Sample200725-vxr83jzzte
  • SHA256 1a4dea5eadd7dd451ad9a13ba19fce11b26e33e0a730662fb39147ea7f0b94bd
  • MD5 SHA1 SHA512
Score
6/10
persistence

Malware Config

Signatures

  • Suspicious use of AdjustPrivilegeToken 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 9862 IoCs
  • Adds Run key to start application 2 TTPs 6 IoCs
    persistence
  • Suspicious use of WriteProcessMemory 170 IoCs
  • Suspicious behavior: MapViewOfSection 15 IoCs
  • Suspicious use of SetThreadContext 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
    "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of SetThreadContext
    PID:1432
    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Adds Run key to start application
      PID:1552
    • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
      "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
      2⤵
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of SetThreadContext
      PID:308
      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
        3⤵
          PID:1096
        • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
          "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
          3⤵
          • Suspicious use of AdjustPrivilegeToken
          • Suspicious use of WriteProcessMemory
          • Suspicious behavior: MapViewOfSection
          • Suspicious use of SetThreadContext
          PID:1392
          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            • Adds Run key to start application
            PID:428
          • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
            "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
            4⤵
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of WriteProcessMemory
            • Suspicious behavior: MapViewOfSection
            • Suspicious use of SetThreadContext
            PID:1168
            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
              5⤵
                PID:1900
              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                5⤵
                  PID:2008
                • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                  "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                  5⤵
                  • Suspicious use of AdjustPrivilegeToken
                  • Suspicious use of WriteProcessMemory
                  • Suspicious behavior: MapViewOfSection
                  • Suspicious use of SetThreadContext
                  PID:2024
                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                    6⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Adds Run key to start application
                    PID:1036
                  • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                    "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                    6⤵
                    • Suspicious use of AdjustPrivilegeToken
                    • Suspicious behavior: MapViewOfSection
                    • Suspicious use of SetThreadContext
                    PID:1400
                    • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                      7⤵
                        PID:1520
                      • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                        "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                        7⤵
                        • Suspicious use of AdjustPrivilegeToken
                        • Suspicious behavior: MapViewOfSection
                        • Suspicious use of SetThreadContext
                        PID:796
                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          • Adds Run key to start application
                          PID:1816
                        • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                          "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                          8⤵
                          • Suspicious use of AdjustPrivilegeToken
                          • Suspicious behavior: MapViewOfSection
                          • Suspicious use of SetThreadContext
                          PID:1676
                          • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                            "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                            9⤵
                              PID:480
                            • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                              "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                              9⤵
                              • Suspicious use of AdjustPrivilegeToken
                              • Suspicious behavior: MapViewOfSection
                              • Suspicious use of SetThreadContext
                              PID:2000
                              • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                10⤵
                                • Suspicious use of AdjustPrivilegeToken
                                • Adds Run key to start application
                                PID:832
                              • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                                "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                                10⤵
                                • Suspicious use of AdjustPrivilegeToken
                                • Suspicious behavior: MapViewOfSection
                                • Suspicious use of SetThreadContext
                                PID:1532
                                • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                  "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                  11⤵
                                    PID:1180
                                  • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                    "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                    11⤵
                                      PID:1096
                                    • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                                      "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                                      11⤵
                                      • Suspicious use of AdjustPrivilegeToken
                                      • Suspicious behavior: MapViewOfSection
                                      • Suspicious use of SetThreadContext
                                      PID:1164
                                      • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                        "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                        12⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Adds Run key to start application
                                        PID:920
                                      • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                                        "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                                        12⤵
                                        • Suspicious use of AdjustPrivilegeToken
                                        • Suspicious behavior: MapViewOfSection
                                        • Suspicious use of SetThreadContext
                                        PID:1664
                                        • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                          "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                          13⤵
                                            PID:672
                                          • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                                            "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                                            13⤵
                                            • Suspicious use of AdjustPrivilegeToken
                                            • Suspicious behavior: MapViewOfSection
                                            • Suspicious use of SetThreadContext
                                            PID:1992
                                            • C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
                                              "C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"
                                              14⤵
                                                PID:764
                                              • C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe
                                                "C:\Users\Admin\AppData\Local\Temp\LC DRAFT COPY_images.exe"
                                                14⤵
                                                  PID:1124

                      Network

                            MITRE ATT&CK Enterprise v6

                            Replay Monitor

                            Loading Replay Monitor...

                            Downloads

                            memory/1552-0-0x0000000000400000-0x000000000044C000-memory.dmp
                            Download

                            memory/1552-2-0x0000000000400000-0x000000000044C000-memory.dmp
                            Download

                            memory/1552-3-0x0000000000400000-0x000000000044C000-memory.dmp
                            Download