Analysis
- max time kernel
148s - max time network
68s - platform
windows10_x64 - resource
win10v200722 - submitted
30/09/2020, 08:23
General
- Target TNT Shippment Documents_pdf.exe
- Size 454KB
- Sample200930-tcbx3fa736
- SHA256 6fcca7d4771894d9ef0df099f61eba0e2c4a6f46a3aa316829e2ff67e133e958
Malware Config
Signatures
- Modifies Windows Defender Real-time Protection settings 3 TTPs
- Looks for VirtualBox Guest Additions in registry 2 TTPs
- Looks for VMWare Tools registry key 2 TTPs
- Checks BIOS information in registry 2 TTPs 2 IoCs
BIOS information is often read in order to detect sandboxing environments.
- Windows security modification 2 TTPs 2 IoCs
- Maps connected drives based on registry 3 TTPs 2 IoCs
Disk information is often read in order to detect sandboxing environments.
- Suspicious use of SetThreadContext 1 IoCs
- Suspicious behavior: EnumeratesProcesses 6 IoCs
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 11 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\TNT Shippment Documents_pdf.exe"C:\Users\Admin\AppData\Local\Temp\TNT Shippment Documents_pdf.exe"1⤵
- Checks BIOS information in registry
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"powershell" Get-MpPreference -verbose2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\TNT Shippment Documents_pdf.exe"C:\Users\Admin\AppData\Local\Temp\TNT Shippment Documents_pdf.exe"2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/780-1-0x00000000715A0000-0x0000000071C8E000-memory.dmp
memory/780-2-0x0000000004F30000-0x0000000004F31000-memory.dmp
memory/780-3-0x0000000007AE0000-0x0000000007AE1000-memory.dmp
memory/780-4-0x0000000007980000-0x0000000007981000-memory.dmp
memory/780-5-0x0000000007A20000-0x0000000007A21000-memory.dmp
memory/780-6-0x0000000008360000-0x0000000008361000-memory.dmp
memory/780-7-0x00000000083D0000-0x00000000083D1000-memory.dmp
memory/780-8-0x0000000008190000-0x0000000008191000-memory.dmp
memory/780-9-0x0000000008AB0000-0x0000000008AB1000-memory.dmp
memory/780-10-0x0000000008A10000-0x0000000008A11000-memory.dmp
memory/780-12-0x0000000009A00000-0x0000000009A33000-memory.dmp
memory/780-19-0x00000000099C0000-0x00000000099C1000-memory.dmp
memory/780-20-0x0000000009B30000-0x0000000009B31000-memory.dmp
memory/780-21-0x0000000009D10000-0x0000000009D11000-memory.dmp
memory/780-22-0x0000000009CA0000-0x0000000009CA1000-memory.dmp
memory/780-24-0x0000000009C90000-0x0000000009C91000-memory.dmp
memory/1960-26-0x0000000000400000-0x000000000043C000-memory.dmp