29bf8be0eca74afc9c497693431e2703fa7a1f4aefe8fce82e3ac7e59e6604d1

Analysis

max time kernel
144s
max time network
145s
platform
windows7_x64
resource
win7v20201028
submitted
08/12/2020, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c610f6ebd52b6f7fe3c5c8016ddfb001.exe
Size 2.5MB
Sample201208-2axfvd8rzn
SHA256 29bf8be0eca74afc9c497693431e2703fa7a1f4aefe8fce82e3ac7e59e6604d1
MD5 c610f6ebd52b6f7fe3c5c8016ddfb001
SHA1 9dd31736b4e6c3e92c17559aa38f9045b7c4f734
SHA512 05664ba4270b5cd30b369ce7b125f478513fdf3ad696e9c39e6b6af8da4481b1398809460c51eba15e9559aca101b457095fe3b1b8ab07033a8047f263204815
MD5 SHA1 SHA512

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1436	sfx.exe

UPX packed file 3 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral1/memory/1328-22-0x0000000000400000-0x000000000074A000-memory.dmp	upx
behavioral1/memory/1328-24-0x0000000000400000-0x000000000074A000-memory.dmp	upx
behavioral1/memory/1328-25-0x0000000000400000-0x000000000074A000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sfx.lnk	sfx.exe

Loads dropped DLL 2 IoCs

pid	Process
1020	cmd.exe
1436	sfx.exe

Suspicious use of NtSetInformationThreadHideFromDebugger 4 IoCs

pid	Process
1328	mscorsvw.exe
1328	mscorsvw.exe
1328	mscorsvw.exe
1328	mscorsvw.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1436 set thread context of 1328	1436	sfx.exe	35

Suspicious behavior: EnumeratesProcesses 2 IoCs

pid	Process
1640	c610f6ebd52b6f7fe3c5c8016ddfb001.exe
1436	sfx.exe

Suspicious use of AdjustPrivilegeToken 4 IoCs

description	pid	Process
Token: SeDebugPrivilege	1640	c610f6ebd52b6f7fe3c5c8016ddfb001.exe
Token: SeDebugPrivilege	1436	sfx.exe
Token: SeDebugPrivilege	1328	mscorsvw.exe
Token: SeShutdownPrivilege	1328	mscorsvw.exe

Suspicious use of SetWindowsHookEx 2 IoCs

pid	Process
1328	mscorsvw.exe
1328	mscorsvw.exe

Suspicious use of WriteProcessMemory 20 IoCs

description	pid	Process	procid_target
PID 1640 wrote to memory of 1940	1640	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	30
PID 1640 wrote to memory of 1940	1640	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	30
PID 1640 wrote to memory of 1940	1640	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	30
PID 1640 wrote to memory of 1940	1640	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	30
PID 1640 wrote to memory of 1020	1640	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	32
PID 1640 wrote to memory of 1020	1640	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	32
PID 1640 wrote to memory of 1020	1640	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	32
PID 1640 wrote to memory of 1020	1640	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	32
PID 1020 wrote to memory of 1436	1020	cmd.exe	34
PID 1020 wrote to memory of 1436	1020	cmd.exe	34
PID 1020 wrote to memory of 1436	1020	cmd.exe	34
PID 1020 wrote to memory of 1436	1020	cmd.exe	34
PID 1436 wrote to memory of 1328	1436	sfx.exe	35
PID 1436 wrote to memory of 1328	1436	sfx.exe	35
PID 1436 wrote to memory of 1328	1436	sfx.exe	35
PID 1436 wrote to memory of 1328	1436	sfx.exe	35
PID 1436 wrote to memory of 1328	1436	sfx.exe	35
PID 1436 wrote to memory of 1328	1436	sfx.exe	35
PID 1436 wrote to memory of 1328	1436	sfx.exe	35
PID 1436 wrote to memory of 1328	1436	sfx.exe	35

C:\Users\Admin\AppData\Local\Temp\c610f6ebd52b6f7fe3c5c8016ddfb001.exe
"C:\Users\Admin\AppData\Local\Temp\c610f6ebd52b6f7fe3c5c8016ddfb001.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:1640
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\c610f6ebd52b6f7fe3c5c8016ddfb001.exe" "C:\Users\Admin\AppData\Roaming\sfx\sfx.exe"
  2⤵
  PID:1940
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\sfx\sfx.exe"
  2⤵
  - Loads dropped DLL
  - Suspicious use of WriteProcessMemory
  PID:1020
- - C:\Users\Admin\AppData\Roaming\sfx\sfx.exe
    "C:\Users\Admin\AppData\Roaming\sfx\sfx.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Loads dropped DLL
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1436
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
      4⤵
      Suspicious use of NtSetInformationThreadHideFromDebugger
      Suspicious use of AdjustPrivilegeToken
      Suspicious use of SetWindowsHookEx
      PID:1328

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1328-22-0x0000000000400000-0x000000000074A000-memory.dmp

Download

memory/1328-28-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1328-27-0x0000000000180000-0x0000000000181000-memory.dmp

Download

memory/1328-26-0x0000000000170000-0x0000000000171000-memory.dmp

Download

memory/1328-25-0x0000000000400000-0x000000000074A000-memory.dmp

Download

memory/1328-24-0x0000000000400000-0x000000000074A000-memory.dmp

Download

memory/1436-21-0x00000000009B0000-0x00000000009BA000-memory.dmp

Download

memory/1436-15-0x0000000001070000-0x0000000001071000-memory.dmp

Download

memory/1436-14-0x0000000073850000-0x0000000073F3E000-memory.dmp

Download

memory/1640-3-0x0000000000F70000-0x0000000000F71000-memory.dmp

Download

memory/1640-2-0x00000000745C0000-0x0000000074CAE000-memory.dmp

Download

memory/1640-5-0x0000000000340000-0x0000000000357000-memory.dmp

Download

memory/1640-6-0x0000000000360000-0x000000000037F000-memory.dmp

Download

memory/1640-7-0x0000000000400000-0x0000000000406000-memory.dmp

Download