Analysis
- max time kernel
136s - max time network
8s - platform
windows7_x64 - resource
win7 - submitted
30/09/2020, 08:23
General
- Target TNT Shippment Documents_pdf.exe
- Size 454KB
- Sample200930-tcbx3fa736
- SHA256 6fcca7d4771894d9ef0df099f61eba0e2c4a6f46a3aa316829e2ff67e133e958
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Windows security modification 2 TTPs 2 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 4 IoCs
- Suspicious use of AdjustPrivilegeToken 2 IoCs
- Suspicious use of WriteProcessMemory 13 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TNT Shippment Documents_pdf.exe"C:\Users\Admin\AppData\Local\Temp\TNT Shippment Documents_pdf.exe"1⤵
- Checks BIOS information in registry
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\TNT Shippment Documents_pdf.exe"C:\Users\Admin\AppData\Local\Temp\TNT Shippment Documents_pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/1332-38-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1332-41-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1332-40-0x0000000000400000-0x000000000043C000-memory.dmp
memory/1884-14-0x0000000006100000-0x0000000006101000-memory.dmp
memory/1884-5-0x0000000004870000-0x0000000004871000-memory.dmp
memory/1884-8-0x0000000005670000-0x0000000005671000-memory.dmp
memory/1884-13-0x0000000005710000-0x0000000005711000-memory.dmp
memory/1884-21-0x0000000006260000-0x0000000006261000-memory.dmp
memory/1884-22-0x0000000005630000-0x0000000005631000-memory.dmp
memory/1884-36-0x0000000006320000-0x0000000006321000-memory.dmp
memory/1884-37-0x0000000006330000-0x0000000006331000-memory.dmp
memory/1884-4-0x00000000025F0000-0x00000000025F1000-memory.dmp
memory/1884-3-0x0000000004920000-0x0000000004921000-memory.dmp
memory/1884-2-0x0000000000630000-0x0000000000631000-memory.dmp
memory/1884-1-0x0000000070BC0000-0x00000000712AE000-memory.dmp