Analysis
- max time kernel
143s - max time network
136s - platform
windows10_x64 - resource
win10v20201028 - submitted
05/12/2020, 19:42
General
- Target SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555.exe
- Size 63KB
- Sample201205-vc86f9s8ke
- SHA256 d6964f92949edac5e3f2b740a6c2fa121eb1539f5a291ee7d4cc5cd55cadd49d
Malware Config
Signatures
- Modifies WinLogon for persistence 2 TTPs 1 IoCs
- Turns off Windows Defender SpyNet reporting 2 TTPs
- Windows security bypass 2 TTPs
- Drops startup file 2 IoCs
- Windows security modification 2 TTPs 11 IoCs
- Adds Run key to start application 2 TTPs 2 IoCs
- Legitimate hosting services abused for malware hosting/C2 1 TTPs
- Suspicious use of NtSetInformationThreadHideFromDebugger 20 IoCs
- Suspicious use of SetThreadContext 1 IoCs
- Program crash 1 IoCs
- Delays execution with timeout.exe 1 IoCs
- Suspicious behavior: EnumeratesProcesses 33 IoCs
- Suspicious use of AdjustPrivilegeToken 9 IoCs
- Suspicious use of SetWindowsHookEx 2 IoCs
- Suspicious use of WriteProcessMemory 33 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555.exe"1⤵
- Modifies WinLogon for persistence
- Drops startup file
- Windows security modification
- Adds Run key to start application
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /c timeout 4.5332⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\timeout.exetimeout 4.5333⤵
- Delays execution with timeout.exe
-
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Windows\SysWOW64\WindowsPowerShell\v1.0\powershell.exe"C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe" Add-MpPreference -ExclusionPath "C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555.exe" -Force2⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555.exe"2⤵
-
-
C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555.exe"C:\Users\Admin\AppData\Local\Temp\SecuriteInfo.com.Trojan.MSIL.Basic.10.Gen.4020.11555.exe"2⤵
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 636 -s 22762⤵
- Program crash
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
-
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/636-8-0x0000000002690000-0x0000000002691000-memory.dmp
memory/636-3-0x0000000000270000-0x0000000000271000-memory.dmp
memory/636-7-0x0000000004D50000-0x0000000004D51000-memory.dmp
memory/636-11-0x0000000011890000-0x0000000011BE1000-memory.dmp
memory/636-2-0x00000000739E0000-0x00000000740CE000-memory.dmp
memory/636-6-0x0000000005250000-0x0000000005251000-memory.dmp
memory/636-5-0x0000000004CB0000-0x0000000004CB1000-memory.dmp
memory/688-57-0x0000000005780000-0x0000000005781000-memory.dmp
memory/688-47-0x0000000004E50000-0x0000000004E51000-memory.dmp
memory/1516-15-0x00000000739E0000-0x00000000740CE000-memory.dmp
memory/1516-18-0x00000000047F0000-0x00000000047F1000-memory.dmp
memory/1516-196-0x0000000009560000-0x0000000009561000-memory.dmp
memory/1516-20-0x0000000007490000-0x0000000007491000-memory.dmp
memory/1516-35-0x00000000072F0000-0x00000000072F1000-memory.dmp
memory/1516-43-0x0000000007CA0000-0x0000000007CA1000-memory.dmp
memory/1516-39-0x00000000073D0000-0x00000000073D1000-memory.dmp
memory/2128-67-0x00000000085F0000-0x00000000085F1000-memory.dmp
memory/2128-192-0x0000000009900000-0x0000000009901000-memory.dmp
memory/2128-17-0x00000000739E0000-0x00000000740CE000-memory.dmp
memory/3012-150-0x0000000008990000-0x00000000089C3000-memory.dmp
memory/3012-25-0x00000000739E0000-0x00000000740CE000-memory.dmp
memory/3012-52-0x00000000073A0000-0x00000000073A1000-memory.dmp
memory/3012-187-0x0000000008AC0000-0x0000000008AC1000-memory.dmp
memory/3012-204-0x0000000008E50000-0x0000000008E51000-memory.dmp
memory/3892-216-0x0000000001210000-0x0000000001211000-memory.dmp
memory/3892-30-0x0000000000400000-0x0000000000737000-memory.dmp
memory/3892-28-0x0000000000400000-0x0000000000737000-memory.dmp
memory/3964-31-0x00000000070B0000-0x00000000070B1000-memory.dmp
memory/3964-48-0x0000000006CC0000-0x0000000006CC1000-memory.dmp
memory/3964-183-0x0000000008320000-0x0000000008321000-memory.dmp
memory/3964-19-0x00000000739E0000-0x00000000740CE000-memory.dmp