Analysis
-
max time kernel
151s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 12:14
Static task
static1
Behavioral task
behavioral1
Sample
4b1cc55485401ff64c0b4fd074f941eb.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
4b1cc55485401ff64c0b4fd074f941eb.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
4b1cc55485401ff64c0b4fd074f941eb.exe
-
Size
152KB
-
MD5
0c006c2d559220f0f18cbd99f6924674
-
SHA1
91fac222a17f3fff564f2c89aac41dd74793eb54
-
SHA256
47ea2f6c893753b726f6192d5a14c681fe0c2da7c741341965cf449be81c18ab
-
SHA512
f925f7189f70fc73736d7b5fa65ae5f86aa93dfb74f240d79ecb6b144f053a75932c071b3b9c7d2053c516d0f873875ee9c55c3473e6c092fb3e6b44f0592951
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\C67499CA = "C:\\Users\\Admin\\AppData\\Roaming\\C67499CA\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe 1868 winver.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 1868 winver.exe 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of UnmapMainImage 1 IoCs
pid Process 1744 4b1cc55485401ff64c0b4fd074f941eb.exe -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1744 wrote to memory of 1868 1744 4b1cc55485401ff64c0b4fd074f941eb.exe 27 PID 1744 wrote to memory of 1868 1744 4b1cc55485401ff64c0b4fd074f941eb.exe 27 PID 1744 wrote to memory of 1868 1744 4b1cc55485401ff64c0b4fd074f941eb.exe 27 PID 1744 wrote to memory of 1868 1744 4b1cc55485401ff64c0b4fd074f941eb.exe 27 PID 1744 wrote to memory of 1868 1744 4b1cc55485401ff64c0b4fd074f941eb.exe 27 PID 1868 wrote to memory of 1268 1868 winver.exe 21 PID 1868 wrote to memory of 1128 1868 winver.exe 19 PID 1868 wrote to memory of 1228 1868 winver.exe 20 PID 1868 wrote to memory of 1268 1868 winver.exe 21
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1228
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1268 -
C:\Users\Admin\AppData\Local\Temp\4b1cc55485401ff64c0b4fd074f941eb.exe"C:\Users\Admin\AppData\Local\Temp\4b1cc55485401ff64c0b4fd074f941eb.exe"2⤵
- Suspicious use of UnmapMainImage
- Suspicious use of WriteProcessMemory
PID:1744 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:1868
-
-