726156ccca0ba0077df20db0e438db482c7197d69453b890332ed69a9e509352

Analysis

max time kernel
115s
max time network
165s
platform
windows10_x64
resource
win10
submitted
19/08/2020, 07:26

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
SCAN123432345432_PDF.exe
Size 80KB
Sample200819-shq5xc6h4e
SHA256 726156ccca0ba0077df20db0e438db482c7197d69453b890332ed69a9e509352
MD5 3085617089f02c7b6fceb69bfac9bdab
SHA1 c199e9589a033335697359b13302efa2f1787687
SHA512 1cb9600d587cebd0c05e44a8d822b9efccb81adc1a472eaaff23f4de1d68fbc46564e27601aa4ed01db4e3bb42f0f0f28bf918c93134d3aa3f6018034a1d033b
MD5 SHA1 SHA512

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Key created	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce	RegAsm.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-2066881839-3229799743-3576549721-1000\Software\Microsoft\Windows\CurrentVersion\RunOnce\Startup key = "C:\\Users\\Admin\\subfolder1\\PICTURE.exe"	RegAsm.exe

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Suspicious use of NtSetInformationThreadHideFromDebugger 2 IoCs

pid	Process
3588	SCAN123432345432_PDF.exe
4068	RegAsm.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 3588 set thread context of 4068	3588	SCAN123432345432_PDF.exe	67

Suspicious behavior: MapViewOfSection 1 IoCs

pid	Process
3588	SCAN123432345432_PDF.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
3588	SCAN123432345432_PDF.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 3588 wrote to memory of 4068	3588	SCAN123432345432_PDF.exe	67
PID 3588 wrote to memory of 4068	3588	SCAN123432345432_PDF.exe	67
PID 3588 wrote to memory of 4068	3588	SCAN123432345432_PDF.exe	67
PID 3588 wrote to memory of 4068	3588	SCAN123432345432_PDF.exe	67

C:\Users\Admin\AppData\Local\Temp\SCAN123432345432_PDF.exe
"C:\Users\Admin\AppData\Local\Temp\SCAN123432345432_PDF.exe"
1⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:3588
- C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe
  "C:\Users\Admin\AppData\Local\Temp\SCAN123432345432_PDF.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious use of NtSetInformationThreadHideFromDebugger
  PID:4068

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Web Service

T1102

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads