29bf8be0eca74afc9c497693431e2703fa7a1f4aefe8fce82e3ac7e59e6604d1

Analysis

max time kernel
143s
max time network
140s
platform
windows10_x64
resource
win10v20201028
submitted
08/12/2020, 18:32

Sharing

Copy URL Twitter E-mail

Report Analysis Logs

General

Target
c610f6ebd52b6f7fe3c5c8016ddfb001.exe
Size 2.5MB
Sample201208-2axfvd8rzn
SHA256 29bf8be0eca74afc9c497693431e2703fa7a1f4aefe8fce82e3ac7e59e6604d1
MD5 c610f6ebd52b6f7fe3c5c8016ddfb001
SHA1 9dd31736b4e6c3e92c17559aa38f9045b7c4f734
SHA512 05664ba4270b5cd30b369ce7b125f478513fdf3ad696e9c39e6b6af8da4481b1398809460c51eba15e9559aca101b457095fe3b1b8ab07033a8047f263204815
MD5 SHA1 SHA512

Score

8^/10

upx

Malware Config

Signatures

Executes dropped EXE 1 IoCs

pid	Process
1688	sfx.exe

UPX packed file 1 IoCs

Detects executables packed with UPX/modified UPX open source packer.

upx

resource	yara_rule
behavioral2/memory/2836-39-0x0000000004910000-0x0000000004C5A000-memory.dmp	upx

Drops startup file 1 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\sfx.lnk	sfx.exe

Suspicious use of SetThreadContext 1 IoCs

description	pid	Process	procid_target
PID 1688 set thread context of 2836	1688	sfx.exe	83

Program crash 1 IoCs

pid	pid_target	Process	procid_target
4012	2836	WerFault.exe	83

Suspicious behavior: EnumeratesProcesses 16 IoCs

pid	Process
4688	c610f6ebd52b6f7fe3c5c8016ddfb001.exe
1688	sfx.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe
4012	WerFault.exe

Suspicious use of AdjustPrivilegeToken 5 IoCs

description	pid	Process
Token: SeDebugPrivilege	4688	c610f6ebd52b6f7fe3c5c8016ddfb001.exe
Token: SeDebugPrivilege	1688	sfx.exe
Token: SeRestorePrivilege	4012	WerFault.exe
Token: SeBackupPrivilege	4012	WerFault.exe
Token: SeDebugPrivilege	4012	WerFault.exe

Suspicious use of WriteProcessMemory 16 IoCs

description	pid	Process	procid_target
PID 4688 wrote to memory of 828	4688	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	78
PID 4688 wrote to memory of 828	4688	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	78
PID 4688 wrote to memory of 828	4688	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	78
PID 4688 wrote to memory of 1320	4688	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	80
PID 4688 wrote to memory of 1320	4688	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	80
PID 4688 wrote to memory of 1320	4688	c610f6ebd52b6f7fe3c5c8016ddfb001.exe	80
PID 1320 wrote to memory of 1688	1320	cmd.exe	82
PID 1320 wrote to memory of 1688	1320	cmd.exe	82
PID 1320 wrote to memory of 1688	1320	cmd.exe	82
PID 1688 wrote to memory of 2836	1688	sfx.exe	83
PID 1688 wrote to memory of 2836	1688	sfx.exe	83
PID 1688 wrote to memory of 2836	1688	sfx.exe	83
PID 1688 wrote to memory of 2836	1688	sfx.exe	83
PID 1688 wrote to memory of 2836	1688	sfx.exe	83
PID 1688 wrote to memory of 2836	1688	sfx.exe	83
PID 1688 wrote to memory of 2836	1688	sfx.exe	83

C:\Users\Admin\AppData\Local\Temp\c610f6ebd52b6f7fe3c5c8016ddfb001.exe
"C:\Users\Admin\AppData\Local\Temp\c610f6ebd52b6f7fe3c5c8016ddfb001.exe"
1⤵
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:4688
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c copy "C:\Users\Admin\AppData\Local\Temp\c610f6ebd52b6f7fe3c5c8016ddfb001.exe" "C:\Users\Admin\AppData\Roaming\sfx\sfx.exe"
  2⤵
  PID:828
- C:\Windows\SysWOW64\cmd.exe
  "C:\Windows\System32\cmd.exe" /c, "C:\Users\Admin\AppData\Roaming\sfx\sfx.exe"
  2⤵
  - Suspicious use of WriteProcessMemory
  PID:1320
- - C:\Users\Admin\AppData\Roaming\sfx\sfx.exe
    "C:\Users\Admin\AppData\Roaming\sfx\sfx.exe"
    3⤵
    - Executes dropped EXE
    - Drops startup file
    - Suspicious use of SetThreadContext
    - Suspicious behavior: EnumeratesProcesses
    - Suspicious use of AdjustPrivilegeToken
    - Suspicious use of WriteProcessMemory
    PID:1688
  - - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
      "C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe"
      4⤵
      PID:2836
    - - C:\Windows\SysWOW64\WerFault.exe
        
        C:\Windows\SysWOW64\WerFault.exe -u -p 2836 -s 204
        5⤵
        Program crash
        Suspicious behavior: EnumeratesProcesses
        Suspicious use of AdjustPrivilegeToken
        
        PID:4012

Network

MITRE ATT&CK Matrix

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1688-33-0x0000000005960000-0x000000000596A000-memory.dmp

Download

memory/1688-34-0x0000000009F50000-0x0000000009F51000-memory.dmp

Download

memory/1688-20-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/2836-39-0x0000000004910000-0x0000000004C5A000-memory.dmp

Download

memory/4012-43-0x0000000004750000-0x0000000004751000-memory.dmp

Download

memory/4688-12-0x0000000009780000-0x0000000009781000-memory.dmp

Download

memory/4688-6-0x00000000019D0000-0x00000000019E7000-memory.dmp

Download

memory/4688-7-0x0000000005710000-0x000000000572F000-memory.dmp

Download

memory/4688-5-0x0000000005740000-0x0000000005741000-memory.dmp

Download

memory/4688-3-0x0000000000CB0000-0x0000000000CB1000-memory.dmp

Download

memory/4688-14-0x0000000009990000-0x0000000009991000-memory.dmp

Download

memory/4688-2-0x0000000073430000-0x0000000073B1E000-memory.dmp

Download

memory/4688-13-0x0000000009E80000-0x0000000009E81000-memory.dmp

Download

memory/4688-8-0x0000000008480000-0x0000000008481000-memory.dmp

Download

memory/4688-11-0x0000000008F80000-0x0000000008F81000-memory.dmp

Download

memory/4688-10-0x00000000051C0000-0x00000000051C6000-memory.dmp

Download

memory/4688-9-0x0000000008060000-0x0000000008061000-memory.dmp

Download