Analysis

  • max time kernel
    58s
  • max time network
    110s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    10-11-2020 06:51

General

  • Target

    107e135cf5c17c5d026138f83302c2f17fa58924298219647ede77dae1a85f84.exe

  • Size

    4.8MB

  • MD5

    ec0e40c558cabb13e01c9440fe757ee7

  • SHA1

    ea387632f8a0e5c9d22a1992c015e129019de62d

  • SHA256

    107e135cf5c17c5d026138f83302c2f17fa58924298219647ede77dae1a85f84

  • SHA512

    21249538c54b7d854e951ab16ffecb1a12af97dcb1595bce269f1e9b288d281be785d89d3bd999866a06990f90d5066f53843f14b1def7c5ba134f34be1af797

Score
8/10
upx

Malware Config

Signatures

  • UPX packed file 106 IoCs

    Detects executables packed with UPX/modified UPX open source packer.

  • Drops desktop.ini file(s) 1 IoCs
  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Drops autorun.inf file 1 TTPs

    Malware can abuse Windows Autorun to spread further via attached volumes.

  • Drops file in Program Files directory 1405 IoCs
  • Program crash 1 IoCs
  • Modifies Internet Explorer start page 1 TTPs 1 IoCs
  • Modifies system certificate store 2 TTPs 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\107e135cf5c17c5d026138f83302c2f17fa58924298219647ede77dae1a85f84.exe
    "C:\Users\Admin\AppData\Local\Temp\107e135cf5c17c5d026138f83302c2f17fa58924298219647ede77dae1a85f84.exe"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • Modifies Internet Explorer start page
    • Modifies system certificate store
    • Suspicious use of AdjustPrivilegeToken
    PID:4692
    • C:\Windows\system32\WerFault.exe
      C:\Windows\system32\WerFault.exe -u -p 4692 -s 1096
      2⤵
      • Program crash
      PID:4260

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/4692-0-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/4692-1-0x0000000000400000-0x00000000010B6000-memory.dmp

    Filesize

    12.7MB

  • memory/4692-4-0x00000000000A0000-0x00000000000A2000-memory.dmp

    Filesize

    8KB

  • memory/4692-5-0x00000000000C0000-0x00000000000D0000-memory.dmp

    Filesize

    64KB

  • memory/4692-6-0x00000000000D0000-0x00000000000D2000-memory.dmp

    Filesize

    8KB

  • memory/4692-7-0x0000000000164000-0x0000000000165000-memory.dmp

    Filesize

    4KB

  • memory/4692-8-0x00000000001D0000-0x00000000001F2000-memory.dmp

    Filesize

    136KB