Overview

overview

8

Static

static

8

080d08c313...e9.exe

windows7_x64

6

080d08c313...e9.exe

windows10_x64

6

Analysis

  • max time kernel
    145s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    08-11-2020 18:00

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe

  • Size

    52KB

  • MD5

    950449f7a3f9040c2326ddcc73776b5e

  • SHA1

    b1045033d3ef88c60aad4c128a6292820258cadf

  • SHA256

    080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9

  • SHA512

    90433ef9539495ef4de10420c12d8cfae511db057957a869f72cc5a8fff0bcf9ff3a08cd2afd2389f30d7b3a10bd6561e4e602b470f8e47072568f51acbd5755

Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Modifies service 2 TTPs 41 IoCs
    persistence
  • Drops file in Windows directory 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 96 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe
    "C:\Users\Admin\AppData\Local\Temp\080d08c313d734957783069a36fcab4160ab9ae212b861ba8b0d241d07777be9.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:756
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localservice -s SstpSvc
    1⤵
      PID:2408
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:2484
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
      1⤵
      • Modifies service
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:2700
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s RasMan
      1⤵
      • Modifies service
      PID:3508

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Modify Existing Service

    1
    T1031

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\INF\netrasa.PNF
      MD5

      80648b43d233468718d717d10187b68d

      SHA1

      a1736e8f0e408ce705722ce097d1adb24ebffc45

      SHA256

      8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

      SHA512

      eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

      Download Submit
    • C:\Windows\INF\netsstpa.PNF
      MD5

      01e21456e8000bab92907eec3b3aeea9

      SHA1

      39b34fe438352f7b095e24c89968fca48b8ce11c

      SHA256

      35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

      SHA512

      9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

      Download Submit