Analysis
-
max time kernel
150s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 12:10
Static task
static1
Behavioral task
behavioral1
Sample
0f3bfa748a771b5e6498d584c15e6995.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
0f3bfa748a771b5e6498d584c15e6995.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
0f3bfa748a771b5e6498d584c15e6995.exe
-
Size
168KB
-
MD5
9a386bbb2de614c64284f2bd63570ff0
-
SHA1
e3ed06a92cb6fb11b2351ce924350937159d0d16
-
SHA256
653c78ce95354e4c3e7a24d3d33de2eac505cc2fd943992c859418813469c4e8
-
SHA512
0668662532992a9dce3987ea18dd0745bf18bc09a8d2cdfb1a505db2c3b404f24736d5c52467e8af4c6a7725e19bdd80c934ea14a6d5b5c262cb8371e5e08c02
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
description ioc Process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\B0E8DD08 = "C:\\Users\\Admin\\AppData\\Roaming\\B0E8DD08\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe 664 winver.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
pid Process 664 winver.exe 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
pid Process 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE 1260 Explorer.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
description pid Process procid_target PID 1360 wrote to memory of 664 1360 0f3bfa748a771b5e6498d584c15e6995.exe 26 PID 1360 wrote to memory of 664 1360 0f3bfa748a771b5e6498d584c15e6995.exe 26 PID 1360 wrote to memory of 664 1360 0f3bfa748a771b5e6498d584c15e6995.exe 26 PID 1360 wrote to memory of 664 1360 0f3bfa748a771b5e6498d584c15e6995.exe 26 PID 1360 wrote to memory of 664 1360 0f3bfa748a771b5e6498d584c15e6995.exe 26 PID 664 wrote to memory of 1260 664 winver.exe 21 PID 664 wrote to memory of 1140 664 winver.exe 19 PID 664 wrote to memory of 1228 664 winver.exe 20 PID 664 wrote to memory of 1260 664 winver.exe 21
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1140
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1228
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1260 -
C:\Users\Admin\AppData\Local\Temp\0f3bfa748a771b5e6498d584c15e6995.exe"C:\Users\Admin\AppData\Local\Temp\0f3bfa748a771b5e6498d584c15e6995.exe"2⤵
- Suspicious use of WriteProcessMemory
PID:1360 -
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:664
-
-