Analysis

  • max time kernel
    59s
  • max time network
    113s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    10-11-2020 07:01

General

  • Target

    896e901cc4aa4995540355e6f66c60519e634f60dae19aa6f653597c792bd453.exe

  • Size

    14.3MB

  • MD5

    ac2f9074de5d6aab7d108f9ad24d75ba

  • SHA1

    5c5d73a6b4e09f7d0dca030d54aa8ffd9310c4ec

  • SHA256

    896e901cc4aa4995540355e6f66c60519e634f60dae19aa6f653597c792bd453

  • SHA512

    9a12e5737a7469ae0978e2dccf194a6c6ee890527661bf04553b05d24539c83c483867e465c91526d0a09f5c031a92c9c9b636ccc04946683fb073c492e12454

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 99 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 2 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops autorun.inf file 1 TTPs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 891 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer start page 1 TTPs 4 IoCs
  • Modifies system certificate store 2 TTPs 8 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\896e901cc4aa4995540355e6f66c60519e634f60dae19aa6f653597c792bd453.exe
    "C:\Users\Admin\AppData\Local\Temp\896e901cc4aa4995540355e6f66c60519e634f60dae19aa6f653597c792bd453.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:3988
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 3988 -s 2020
      2⤵
      • Program crash
      PID:904

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/3988-0-0x0000000000400000-0x00000000010B8000-memory.dmp

    Filesize

    12.7MB

  • memory/3988-3-0x0000000000180000-0x0000000000190000-memory.dmp

    Filesize

    64KB

  • memory/3988-4-0x0000000000190000-0x00000000001A0000-memory.dmp

    Filesize

    64KB

  • memory/3988-5-0x00000000001A0000-0x00000000001A2000-memory.dmp

    Filesize

    8KB

  • memory/3988-6-0x00000000001B0000-0x00000000001F0000-memory.dmp

    Filesize

    256KB

  • memory/3988-7-0x00000000001F0000-0x0000000000200000-memory.dmp

    Filesize

    64KB