Analysis
-
max time kernel
150s -
max time network
145s -
platform
windows7_x64 -
resource
win7v20201028 -
submitted
17-11-2020 15:20
Static task
static1
Behavioral task
behavioral1
Sample
aa02188daab3faaaba74081d7e9a4986.exe
Resource
win7v20201028
windows7_x64
0 signatures
0 seconds
Behavioral task
behavioral2
Sample
aa02188daab3faaaba74081d7e9a4986.exe
Resource
win10v20201028
windows10_x64
0 signatures
0 seconds
General
-
Target
aa02188daab3faaaba74081d7e9a4986.exe
-
Size
184KB
-
MD5
f59deb960309edee8ff6eee523f52006
-
SHA1
933ab0fec556e4cd02d7971ec7fc0a3f1c000b8a
-
SHA256
d7754476cbf09c62d377387cc0cea85bdad171cec82388f4ab2e2accf1d1f876
-
SHA512
ff5ff71b5e47800429e77df9a491300bc282f4fec0133151e72611969257eb553e2c5441c7faec8b22a67d7c645ea5ca4c87f73c73b236cca8bf910cc6526f5d
Score
10/10
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\6502DC56 = "C:\\Users\\Admin\\AppData\\Roaming\\6502DC56\\bin.exe" winver.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe 1780 winver.exe -
Suspicious use of AdjustPrivilegeToken 64 IoCs
Processes:
aa02188daab3faaaba74081d7e9a4986.exedescription pid process Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe Token: SeLoadDriverPrivilege 1892 aa02188daab3faaaba74081d7e9a4986.exe -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
winver.exeExplorer.EXEpid process 1780 winver.exe 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE 1268 Explorer.EXE -
Suspicious use of WriteProcessMemory 9 IoCs
Processes:
aa02188daab3faaaba74081d7e9a4986.exewinver.exedescription pid process target process PID 1892 wrote to memory of 1780 1892 aa02188daab3faaaba74081d7e9a4986.exe winver.exe PID 1892 wrote to memory of 1780 1892 aa02188daab3faaaba74081d7e9a4986.exe winver.exe PID 1892 wrote to memory of 1780 1892 aa02188daab3faaaba74081d7e9a4986.exe winver.exe PID 1892 wrote to memory of 1780 1892 aa02188daab3faaaba74081d7e9a4986.exe winver.exe PID 1892 wrote to memory of 1780 1892 aa02188daab3faaaba74081d7e9a4986.exe winver.exe PID 1780 wrote to memory of 1268 1780 winver.exe Explorer.EXE PID 1780 wrote to memory of 1128 1780 winver.exe taskhost.exe PID 1780 wrote to memory of 1228 1780 winver.exe Dwm.exe PID 1780 wrote to memory of 1268 1780 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\aa02188daab3faaaba74081d7e9a4986.exe"C:\Users\Admin\AppData\Local\Temp\aa02188daab3faaaba74081d7e9a4986.exe"2⤵
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver3⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1128-2-0x0000000000210000-0x0000000000216000-memory.dmpFilesize
24KB
-
memory/1228-3-0x0000000001AD0000-0x0000000001AD6000-memory.dmpFilesize
24KB
-
memory/1268-1-0x00000000025A0000-0x00000000025A6000-memory.dmpFilesize
24KB
-
memory/1268-4-0x00000000025B0000-0x00000000025B6000-memory.dmpFilesize
24KB
-
memory/1780-0-0x0000000000000000-mapping.dmp