Overview

overview

8

Static

static

8

ae4cc675f5...e2.exe

windows7_x64

6

ae4cc675f5...e2.exe

windows10_x64

6

Analysis

  • max time kernel
    53s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    08-11-2020 18:02

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe

  • Size

    50KB

  • MD5

    745ded2f0c2c9b07ca67542af6bdd031

  • SHA1

    43b9140d519c05bf0ff413d0bba1a90a03a132e2

  • SHA256

    ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2

  • SHA512

    f628aa8bc831e46291d7b76ae59ebd650fff694ecb0254ebd7a05452bbf2f32d5552775c981563f2de28396f341a5aac3cc73a5701a55f7ad8a849926b38df20

Score
6/10
discoverypersistence

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • Modifies service 2 TTPs 41 IoCs
    persistence
  • Drops file in Windows directory 4 IoCs
  • Checks SCSI registry key(s) 3 TTPs 96 IoCs

    SCSI information is often read in order to detect sandboxing environments.

  • Modifies data under HKEY_USERS 2 IoCs
  • Suspicious behavior: LoadsDriver 6 IoCs
  • Suspicious use of AdjustPrivilegeToken 18 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe
    "C:\Users\Admin\AppData\Local\Temp\ae4cc675f5090aa1c90f406f508b71c960c3541a5fe8a01be3b1d3547c7c9ae2.exe"
    1⤵
    • Adds Run key to start application
    • Drops file in Windows directory
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:500
  • \??\c:\windows\system32\svchost.exe
    c:\windows\system32\svchost.exe -k localservice -s SstpSvc
    1⤵
      PID:688
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s DsmSvc
      1⤵
      • Drops file in Windows directory
      • Checks SCSI registry key(s)
      • Modifies data under HKEY_USERS
      PID:3028
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s NetSetupSvc
      1⤵
      • Modifies service
      • Drops file in Windows directory
      • Suspicious use of AdjustPrivilegeToken
      PID:1772
    • \??\c:\windows\system32\svchost.exe
      c:\windows\system32\svchost.exe -k netsvcs -s RasMan
      1⤵
      • Modifies service
      PID:2896

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Modify Existing Service

    1
    T1031

    Privilege Escalation

    Defense Evasion

    Modify Registry

    2
    T1112

    Credential Access

    Discovery

    Query Registry

    2
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Windows\INF\netrasa.PNF
      MD5

      80648b43d233468718d717d10187b68d

      SHA1

      a1736e8f0e408ce705722ce097d1adb24ebffc45

      SHA256

      8ab9a39457507e405ade5ef9d723e0f89bc46d8d8b33d354b00d95847f098380

      SHA512

      eec0ac7e7abcf87b3f0f4522b0dd95c658327afb866ceecff3c9ff0812a521201d729dd71d43f3ac46536f8435d4a49ac157b6282077c7c1940a6668f3b3aea9

      Download Submit
    • C:\Windows\INF\netsstpa.PNF
      MD5

      01e21456e8000bab92907eec3b3aeea9

      SHA1

      39b34fe438352f7b095e24c89968fca48b8ce11c

      SHA256

      35ad0403fdef3fce3ef5cd311c72fef2a95a317297a53c02735cda4bd6e0c74f

      SHA512

      9d5153450e8fe3f51f20472bae4a2ab2fed43fad61a89b04a70325559f6ffed935dd72212671cc6cfc0288458d359bc71567f0d9af8e5770d696adc5bdadd7ec

      Download Submit