Overview

overview

8

Static

static

8

BH.exe

windows7_x64

8

BH.exe

windows10_x64

Analysis

  • max time kernel
    69s
  • max time network
    68s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    26-11-2020 08:29

Sharing

Copy URL
Twitter E-mail

Errors

Reason
Machine shutdown
Report Analysis Logs

General

  • Target

    BH.exe

  • Size

    560KB

  • MD5

    5e1532ecfc1d63bc6f02645b49854db1

  • SHA1

    fa3b3888345c2c653ccc8fc2cf3662f789e78ab4

  • SHA256

    10b5b127d0c994ce5b7977b3f268f43e84dcff56512a0d6947891235d9adb966

  • SHA512

    d660e750b7a6bb0642f215422e9893cd13bc83d549d16cbe8d4fea11a64d517d008a020c59607b569fcfa3782e1b18ddc3da77461a64b9deed1a23727ec97833

Score
8/10
evasionpersistence

Malware Config

Signatures

  • Disables RegEdit via registry modification
    evasion
  • Disables cmd.exe use via registry modification
    evasion
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious behavior: LoadsDriver 12084 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\BH.exe
    "C:\Users\Admin\AppData\Local\Temp\BH.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of SetWindowsHookEx
    PID:4756
  • \??\c:\windows\system32\sihost.exe
    sihost.exe
    1⤵
      PID:2816
    • \??\c:\windows\system32\sihost.exe
      sihost.exe
      1⤵
        PID:4328
      • \??\c:\windows\system32\sihost.exe
        sihost.exe
        1⤵
          PID:2088
        • \??\c:\windows\system32\sihost.exe
          sihost.exe
          1⤵
            PID:576
          • \??\c:\windows\system32\sihost.exe
            sihost.exe
            1⤵
              PID:568
            • \??\c:\windows\system32\sihost.exe
              sihost.exe
              1⤵
                PID:668

              Network

              MITRE ATT&CK Matrix ATT&CK v6

              Initial Access

              Execution

              Persistence

              Registry Run Keys / Startup Folder

              1
              T1060

              Privilege Escalation

              Defense Evasion

              Modify Registry

              1
              T1112

              Credential Access

              Discovery

              Lateral Movement

              Collection

              Exfiltration

              Command and Control

              Impact

              Replay Monitor

              Loading Replay Monitor...

              Downloads

              • memory/4756-0-0x0000000004F90000-0x0000000004F91000-memory.dmp
                Filesize

                4KB

                Download
              • memory/4756-2-0x0000000004F90000-0x0000000004F91000-memory.dmp
                Filesize

                4KB

                Download