Analysis
-
max time kernel
51s -
max time network
52s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
08-11-2020 18:00
Static task
static1
Behavioral task
behavioral1
Sample
080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe
Resource
win10v20201028
General
-
Target
080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe
-
Size
52KB
-
MD5
950449f7a3f9040c2326ddcc73776b5e
-
SHA1
b1045033d3ef88c60aad4c128a6292820258cadf
-
SHA256
080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9
-
SHA512
90433ef9539495ef4de10420c12d8cfae511db057957a869f72cc5a8fff0bcf9ff3a08cd2afd2389f30d7b3a10bd6561e4e602b470f8e47072568f51acbd5755
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run 080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9 = "c:\\windows\\080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe -m" 080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe -
Checks installed software on the system 1 TTPs
Looks up Uninstall key entries in the registry to enumerate software on the system.
-
Drops file in Windows directory 2 IoCs
Processes:
080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exedescription ioc process File created \??\c:\windows\080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe 080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe File opened for modification \??\c:\windows\080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe 080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe -
Suspicious use of FindShellTrayWindow 1 IoCs
Processes:
080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exepid process 1684 080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe -
Suspicious use of SendNotifyMessage 1 IoCs
Processes:
080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exepid process 1684 080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe"C:\Users\Admin\AppData\Local\Temp\080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe"1⤵
- Adds Run key to start application
- Drops file in Windows directory
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage