Analysis

  • max time kernel
    55s
  • max time network
    65s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    10/11/2020, 06:57

General

  • Target
    8c2c1a38245a60815477308d2b10216cd562e295d1f7ddba62cb74c0b3381dae.exe
  • Size 10.7MB
  • Sample201110-5k1e6pszbe
  • SHA256 8c2c1a38245a60815477308d2b10216cd562e295d1f7ddba62cb74c0b3381dae
  • MD5 SHA1 SHA512
Score
6/10

Malware Config

Signatures

  • Adds Run key to start application 2 TTPs 1 IoCs
  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 1300 IoCs
  • Modifies Internet Explorer start page 1 TTPs 3 IoCs
  • Modifies system certificate store 2 TTPs 14 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\8c2c1a38245a60815477308d2b10216cd562e295d1f7ddba62cb74c0b3381dae.exe
    "C:\Users\Admin\AppData\Local\Temp\8c2c1a38245a60815477308d2b10216cd562e295d1f7ddba62cb74c0b3381dae.exe"
    1⤵
    • Adds Run key to start application
    • Drops desktop.ini file(s)
    • Drops file in System32 directory
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:648

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/648-0-0x0000000000400000-0x00000000010B2000-memory.dmp

        memory/648-1-0x0000000000400000-0x00000000010B2000-memory.dmp

        memory/648-2-0x0000000000400000-0x00000000010B2000-memory.dmp

        memory/648-3-0x0000000000400000-0x00000000010B2000-memory.dmp

        memory/648-4-0x00000000002F0000-0x0000000000330000-memory.dmp

        memory/648-5-0x0000000000330000-0x0000000000352000-memory.dmp

        memory/648-6-0x0000000000360000-0x0000000000370000-memory.dmp

        memory/648-7-0x0000000000370000-0x0000000000380000-memory.dmp

        memory/648-8-0x0000000000380000-0x0000000000390000-memory.dmp

        memory/648-9-0x0000000000390000-0x00000000003A0000-memory.dmp

        memory/648-10-0x00000000003A0000-0x00000000003A2000-memory.dmp

        memory/648-11-0x00000000003B0000-0x00000000003F0000-memory.dmp