619a5e8a0ade93b187c7f438bcb7c5bb15a33da3148176513a2c0010c7960cd4

Analysis

max time kernel
21s
max time network
142s
platform
windows10_x64
resource
win10v20201028
submitted
09/11/2020, 19:40

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
b2c5a2120c0867df88415ffd14d34064.exe
Size 481KB
Sample201109-pbb46sqtrj
SHA256 619a5e8a0ade93b187c7f438bcb7c5bb15a33da3148176513a2c0010c7960cd4
MD5 b2c5a2120c0867df88415ffd14d34064
SHA1 66438933875a3bceba927e754312e4c1d5410de6
SHA512 25cfd4a4d7c3910adb6cc650914ac3740abf0240c3566dd6a87f9e2db37e70ff900fbe36b97368a7cd7c31a6e60fd807bd663a5b81610fc19b5a66a375061f79
MD5 SHA1 SHA512

Score

10^/10

evasion trojan

Malware Config

Signatures

Modifies Windows Defender Real-time Protection settings 3 TTPs
evasion trojan

Modify Registry
T1112

Modify Existing Service
T1031

Disabling Security Tools
T1089
Looks for VirtualBox Guest Additions in registry 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497
Looks for VMWare Tools registry key 2 TTPs
evasion

Query Registry
T1012

Virtualization/Sandbox Evasion
T1497

Checks BIOS information in registry 2 TTPs 2 IoCs

BIOS information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\SystemBiosVersion	b2c5a2120c0867df88415ffd14d34064.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\VideoBiosVersion	b2c5a2120c0867df88415ffd14d34064.exe

Windows security modification 2 TTPs 2 IoCs

evasion trojan

Disabling Security Tools

T1089

Modify Registry

T1112

description	ioc	Process
Set value (int)	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features\TamperProtection = "0"	b2c5a2120c0867df88415ffd14d34064.exe
Key created	\REGISTRY\MACHINE\SOFTWARE\WOW6432Node\Microsoft\Windows Defender\Features	b2c5a2120c0867df88415ffd14d34064.exe

Maps connected drives based on registry 3 TTPs 2 IoCs

Disk information is often read in order to detect sandboxing environments.

Query Registry

T1012

Peripheral Device Discovery

T1120

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum	b2c5a2120c0867df88415ffd14d34064.exe
Key value queried	\REGISTRY\MACHINE\SYSTEM\ControlSet001\Services\Disk\Enum\0	b2c5a2120c0867df88415ffd14d34064.exe

Suspicious behavior: EnumeratesProcesses 5 IoCs

pid	Process
1504	powershell.exe
1504	powershell.exe
1504	powershell.exe
3876	dw20.exe
3876	dw20.exe

Suspicious use of AdjustPrivilegeToken 3 IoCs

description	pid	Process
Token: SeDebugPrivilege	1504	powershell.exe
Token: SeRestorePrivilege	3876	dw20.exe
Token: SeBackupPrivilege	3876	dw20.exe

Suspicious use of WriteProcessMemory 6 IoCs

description	pid	Process	procid_target
PID 1028 wrote to memory of 1504	1028	b2c5a2120c0867df88415ffd14d34064.exe	79
PID 1028 wrote to memory of 1504	1028	b2c5a2120c0867df88415ffd14d34064.exe	79
PID 1028 wrote to memory of 1504	1028	b2c5a2120c0867df88415ffd14d34064.exe	79
PID 1028 wrote to memory of 3876	1028	b2c5a2120c0867df88415ffd14d34064.exe	82
PID 1028 wrote to memory of 3876	1028	b2c5a2120c0867df88415ffd14d34064.exe	82
PID 1028 wrote to memory of 3876	1028	b2c5a2120c0867df88415ffd14d34064.exe	82

C:\Users\Admin\AppData\Local\Temp\b2c5a2120c0867df88415ffd14d34064.exe
"C:\Users\Admin\AppData\Local\Temp\b2c5a2120c0867df88415ffd14d34064.exe"
1⤵
- Checks BIOS information in registry
- Windows security modification
- Maps connected drives based on registry
- Suspicious use of WriteProcessMemory
PID:1028
- C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe
  "powershell" Get-MpPreference -verbose
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:1504
- C:\Windows\Microsoft.NET\Framework\v2.0.50727\dw20.exe
  dw20.exe -x -s 1700
  2⤵
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:3876

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Modify Existing Service

T1031

Privilege Escalation

Defense Evasion

Disabling Security Tools

T1089

Modify Registry

T1112

Virtualization/Sandbox Evasion

T1497

Credential Access

Discovery

Peripheral Device Discovery

T1120

Query Registry

T1012

System Information Discovery

T1082

Virtualization/Sandbox Evasion

T1497

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1504-1-0x00000000712B0000-0x000000007199E000-memory.dmp

Download

memory/1504-2-0x0000000004CA0000-0x0000000004CA1000-memory.dmp

Download

memory/1504-3-0x0000000007720000-0x0000000007721000-memory.dmp

Download

memory/1504-4-0x00000000075F0000-0x00000000075F1000-memory.dmp

Download

memory/1504-5-0x0000000007DC0000-0x0000000007DC1000-memory.dmp

Download

memory/1504-6-0x0000000007E30000-0x0000000007E31000-memory.dmp

Download

memory/1504-7-0x0000000008080000-0x0000000008081000-memory.dmp

Download

memory/1504-8-0x0000000008490000-0x0000000008491000-memory.dmp

Download

memory/1504-9-0x00000000084C0000-0x00000000084C1000-memory.dmp

Download

memory/1504-10-0x0000000008840000-0x0000000008841000-memory.dmp

Download

memory/1504-12-0x0000000009540000-0x0000000009573000-memory.dmp

Download

memory/1504-19-0x0000000009520000-0x0000000009521000-memory.dmp

Download

memory/1504-20-0x0000000009910000-0x0000000009911000-memory.dmp

Download

memory/1504-21-0x0000000009A70000-0x0000000009A71000-memory.dmp

Download

memory/1504-22-0x0000000009A10000-0x0000000009A11000-memory.dmp

Download

memory/1504-24-0x0000000009A00000-0x0000000009A01000-memory.dmp

Download

memory/3876-27-0x0000000002890000-0x0000000002891000-memory.dmp

Download

memory/3876-29-0x0000000002F40000-0x0000000002F41000-memory.dmp

Download