Analysis
-
max time kernel
14s -
max time network
22s -
platform
windows7_x64 -
resource
win7 -
submitted
07-09-2020 08:19
Static task
static1
Behavioral task
behavioral1
Sample
bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe
Resource
win7
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe
Resource
win10v200722
windows10_x64
0 signatures
0 seconds
Errors
Reason
Machine shutdown
General
-
Target
bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe
-
Size
14KB
-
MD5
bdb77b2f35c0f3e79853ea7f8bdf5b29
-
SHA1
72de04ee453d053c98ee3047574b0cf6c23b0d33
-
SHA256
4d27264a659cc593d5c936a36942835450b97aacf12b7b1673dc1afc01b420ef
-
SHA512
c2bb90612d76c3f572c1c62c9ecb1abf9581aebfcf07f459ad79bc7910480e6f5628af8f1deed54162ad070d759b2f237cadd2ce17c21318f275e8793d06ae74
Score
6/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 1 IoCs
Processes:
bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exedescription ioc process Set value (str) \REGISTRY\USER\S-1-5-21-1131729243-447456001-3632642222-1000\Software\Microsoft\Windows\CurrentVersion\Run\Run = "C:\\Users\\Admin\\AppData\\Local\\Temp\\4fywvjly.tu5.exe" bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe -
Suspicious use of AdjustPrivilegeToken 2 IoCs
Processes:
shutdown.exedescription pid process Token: SeShutdownPrivilege 1764 shutdown.exe Token: SeRemoteShutdownPrivilege 1764 shutdown.exe -
Suspicious use of WriteProcessMemory 6 IoCs
Processes:
bdb77b2f35c0f3e79853ea7f8bdf5b29.in.execmd.exedescription pid process target process PID 1460 wrote to memory of 1788 1460 bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe cmd.exe PID 1460 wrote to memory of 1788 1460 bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe cmd.exe PID 1460 wrote to memory of 1788 1460 bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe cmd.exe PID 1788 wrote to memory of 1764 1788 cmd.exe shutdown.exe PID 1788 wrote to memory of 1764 1788 cmd.exe shutdown.exe PID 1788 wrote to memory of 1764 1788 cmd.exe shutdown.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe"C:\Users\Admin\AppData\Local\Temp\bdb77b2f35c0f3e79853ea7f8bdf5b29.in.exe"1⤵
- Adds Run key to start application
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\cmd.execmd /c ""C:\Users\Admin\AppData\Local\Temp\m5u0uccp.na0.bat""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\shutdown.exeshutdown /f /r /t 03⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x11⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Temp\m5u0uccp.na0.bat
-
memory/1460-0-0x000007FEF58D0000-0x000007FEF62BC000-memory.dmpFilesize
9.9MB
-
memory/1460-1-0x0000000000C70000-0x0000000000C71000-memory.dmpFilesize
4KB
-
memory/1764-5-0x0000000000000000-mapping.dmp
-
memory/1788-3-0x0000000000000000-mapping.dmp