Analysis
-
max time kernel
151s -
max time network
152s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 12:32
Static task
static1
Behavioral task
behavioral1
Sample
615c8b816f4ecf1acfd5418a44b19e3f.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
615c8b816f4ecf1acfd5418a44b19e3f.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
615c8b816f4ecf1acfd5418a44b19e3f.exe
-
Size
92KB
-
MD5
76187f5f99dffd2633a9877ed93dfbe6
-
SHA1
8643ef0fd80a232d5b7c91fece9437a8c09af48e
-
SHA256
1cb62ba1c9e13ce33e23dc9a015e37b50ac97359ffe85b500d03d47b417156cc
-
SHA512
a3ae4aad347667aae86780af6ae2fec4c1b9782287da622845857945a8a3552b059c575bf050611ea53890b5fc2b27e8db06f77db93942a2bc2f484d473f411c
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc Process Key created \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-293278959-2699126792-324916226-1000\Software\Microsoft\Windows\CurrentVersion\Run\C7700B25 = "C:\\Users\\Admin\\AppData\\Roaming\\C7700B25\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid Process 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe 1436 winver.exe -
Suspicious use of FindShellTrayWindow 4 IoCs
Processes:
Explorer.EXEpid Process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid Process 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE 1236 Explorer.EXE -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
615c8b816f4ecf1acfd5418a44b19e3f.exewinver.exedescription pid Process procid_target PID 1080 wrote to memory of 1436 1080 615c8b816f4ecf1acfd5418a44b19e3f.exe 25 PID 1080 wrote to memory of 1436 1080 615c8b816f4ecf1acfd5418a44b19e3f.exe 25 PID 1080 wrote to memory of 1436 1080 615c8b816f4ecf1acfd5418a44b19e3f.exe 25 PID 1080 wrote to memory of 1436 1080 615c8b816f4ecf1acfd5418a44b19e3f.exe 25 PID 1080 wrote to memory of 1436 1080 615c8b816f4ecf1acfd5418a44b19e3f.exe 25 PID 1436 wrote to memory of 1116 1436 winver.exe 19 PID 1436 wrote to memory of 1176 1436 winver.exe 20 PID 1436 wrote to memory of 1236 1436 winver.exe 21
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1116
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1176
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1236 -
C:\Users\Admin\AppData\Local\Temp\615c8b816f4ecf1acfd5418a44b19e3f.exe"C:\Users\Admin\AppData\Local\Temp\615c8b816f4ecf1acfd5418a44b19e3f.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1080 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
PID:1436
-
-