Analysis
- max time kernel
78s - max time network
150s - platform
windows10_x64 - resource
win10 - submitted
01/09/2020, 09:27
General
- Target e1612e3d774b3ebd2559eb3ec8b59890d64712386563bee84da82e7b7dfbebe7.exe
- Size 1.3MB
- Sample200901-msfytp9nms
- SHA256 e1612e3d774b3ebd2559eb3ec8b59890d64712386563bee84da82e7b7dfbebe7
Score
8/10
Malware Config
Signatures
- Executes dropped EXE 1 IoCs
- Loads dropped DLL 1 IoCs
- Enumerates connected drives 3 TTPs
- Drops file in Windows directory 1 IoCs
- Modifies data under HKEY_USERS 5 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of SetWindowsHookEx 1 IoCs
- Suspicious use of WriteProcessMemory 3 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\e1612e3d774b3ebd2559eb3ec8b59890d64712386563bee84da82e7b7dfbebe7.exe"C:\Users\Admin\AppData\Local\Temp\e1612e3d774b3ebd2559eb3ec8b59890d64712386563bee84da82e7b7dfbebe7.exe"1⤵
- Loads dropped DLL
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\Everything\Everything.exeC:\Users\Admin\AppData\Local\Temp\Everything\Everything.exe2⤵
- Executes dropped EXE
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\system32\svchost.exeC:\Windows\system32\svchost.exe -k LocalService -s WinHttpAutoProxySvc1⤵
- Drops file in Windows directory
- Modifies data under HKEY_USERS
- Suspicious use of AdjustPrivilegeToken