Analysis
- max time kernel
115s - max time network
118s - platform
windows10_x64 - resource
win10 - submitted
29/07/2020, 16:15
Static task
static1
Behavioral task
behavioral1
Sample
95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe
Resource
win7v200722
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe
Resource
win10
windows10_x64
0 signatures
0 seconds
General
- Target 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe
- Size 11.2MB
- Sample200729-hzgfz2dk3a
- SHA256 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93
- MD5 141aaca3af3e2bd46663d723524a7425
- SHA1 671af035f7ad41d4ddb29fe63fff129ee3cd495f
- SHA512 a962ca8f6df4f41ba2a9a8fffdb8c7e1c90d42fa7e63b50744f96c06b0d6f566f2bb95863dde3f417ad761fc41e19ee147a949bd9d621b5da61ea13c3a170418
- MD5 SHA1 SHA512
Score
7/10
Malware Config
Signatures
- Suspicious use of WriteProcessMemory 3 IoCs
description pid Process procid_target PID 3588 wrote to memory of 3028 3588 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 67 PID 3588 wrote to memory of 3028 3588 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 67 PID 3588 wrote to memory of 3028 3588 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 67 - Loads dropped DLL 41 IoCs
pid Process 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe - Suspicious use of AdjustPrivilegeToken 1 IoCs
description pid Process Token: 35 3028 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe - JavaScript code in executable 7 IoCs
resource yara_rule behavioral2/files/0x000100000001adbe-1.dat js behavioral2/files/0x000100000001adbe-2.dat js behavioral2/files/0x000100000001add1-5.dat js behavioral2/files/0x000100000001adbf-10.dat js behavioral2/files/0x000100000001adbf-11.dat js behavioral2/files/0x000100000001adc6-14.dat js behavioral2/files/0x000100000001adc6-15.dat js - Adds Run key to start application 2 TTPs 1 IoCs
description ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\Run\Crypter = "C:\\Users\\Admin\\AppData\\Local\\Temp\\95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe" 95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe"C:\Users\Admin\AppData\Local\Temp\95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe"1⤵
- Suspicious use of WriteProcessMemory
PID:3588 -
C:\Users\Admin\AppData\Local\Temp\95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe"C:\Users\Admin\AppData\Local\Temp\95e35f1614df92a318a749a8f62a35b9c03f2f34f08ad5606b45c9d817ff1d93.exe"2⤵
- Loads dropped DLL
- Suspicious use of AdjustPrivilegeToken
- Adds Run key to start application
PID:3028
-