Analysis
-
max time kernel
117s -
max time network
152s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
24-11-2020 02:32
General
-
Target
466d872ddb9f8ce7db8d16d171b9ba398f99c98c79e63396760cda7426d9460d.exe
-
Size
5.6MB
-
MD5
6566030bb1580c5a347d925bfc280439
-
SHA1
31a8a4fb514cef40af7cd8cfbab1b568aff56d73
-
SHA256
466d872ddb9f8ce7db8d16d171b9ba398f99c98c79e63396760cda7426d9460d
-
SHA512
da565d4f38807d170fe34a4523327958ffc56801b91f29471c815f3e7d133699e305360a0abdd508ba95d81a85ed01fea73f0c397d642fed2de05b4a90ccb76f
Malware Config
Signatures
-
Modifies Windows Defender Real-time Protection settings 3 TTPs
-
ServiceHost packer 13 IoCs
Detects ServiceHost packer used for .NET malware
-
Executes dropped EXE 1 IoCs
-
VMProtect packed file 3 IoCs
Detects executables packed with VMProtect commercial packer.
-
Checks BIOS information in registry 2 TTPs 1 IoCs
BIOS information is often read in order to detect sandboxing environments.
-
Program crash 1 IoCs
-
Creates scheduled task(s) 1 TTPs 1 IoCs
Schtasks is often used by malware for persistence or to perform post-infection execution.
-
Suspicious behavior: EnumeratesProcesses 21 IoCs
-
Suspicious use of AdjustPrivilegeToken 3 IoCs
-
Suspicious use of WriteProcessMemory 6 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\466d872ddb9f8ce7db8d16d171b9ba398f99c98c79e63396760cda7426d9460d.exe"C:\Users\Admin\AppData\Local\Temp\466d872ddb9f8ce7db8d16d171b9ba398f99c98c79e63396760cda7426d9460d.exe"1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Roaming\Java Update\jvm.exe"C:\Users\Admin\AppData\Roaming\Java Update\jvm.exe"2⤵
- Executes dropped EXE
- Checks BIOS information in registry
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\schtasks.exe"C:\Windows\system32\schtasks.exe" /create /f /sc ONSTART /RL HIGHEST /tn "Java Update" /tr "C:\Users\Admin\AppData\Roaming\Java Update\jvm.exe"3⤵
- Creates scheduled task(s)
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 2908 -s 14083⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
MD5
6566030bb1580c5a347d925bfc280439
SHA131a8a4fb514cef40af7cd8cfbab1b568aff56d73
SHA256466d872ddb9f8ce7db8d16d171b9ba398f99c98c79e63396760cda7426d9460d
SHA512da565d4f38807d170fe34a4523327958ffc56801b91f29471c815f3e7d133699e305360a0abdd508ba95d81a85ed01fea73f0c397d642fed2de05b4a90ccb76f
-
MD5
6566030bb1580c5a347d925bfc280439
SHA131a8a4fb514cef40af7cd8cfbab1b568aff56d73
SHA256466d872ddb9f8ce7db8d16d171b9ba398f99c98c79e63396760cda7426d9460d
SHA512da565d4f38807d170fe34a4523327958ffc56801b91f29471c815f3e7d133699e305360a0abdd508ba95d81a85ed01fea73f0c397d642fed2de05b4a90ccb76f
-
-
Filesize
4KB
-
Filesize
4KB
-
Filesize
4KB
-
-
-
-
-
-
-
-
-
-
-
-
-
-