Overview

overview

8

Static

static

d266c6f4f8...ff.exe

windows7_x64

8

d266c6f4f8...ff.exe

windows10_x64

8

Analysis

  • max time kernel
    149s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    14/12/2020, 20:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d266c6f4f8b8404c2d2ebdb8d4065fff.exe
  • Size 502KB
  • Sample201214-36gwfdqvms
  • SHA256 1735709e4b496d80858a5d3cbcf9e7aef536ff439fa04d28be863dd3135dee61
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d266c6f4f8b8404c2d2ebdb8d4065fff.exe
    "C:\Users\Admin\AppData\Local\Temp\d266c6f4f8b8404c2d2ebdb8d4065fff.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1204
    • C:\Windows\system32\schtasks.exe
      "schtasks" /create /tn "Windows Security notification icon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\d266c6f4f8b8404c2d2ebdb8d4065fff.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:836
    • C:\Users\Admin\AppData\Roaming\Win32\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Win32\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:1844
      • C:\Windows\system32\schtasks.exe
        "schtasks" /create /tn "Windows Security notification icon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Win32\svchost.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:1504

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/1204-2-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp
        Download

        memory/1204-3-0x0000000000E30000-0x0000000000E31000-memory.dmp
        Download

        memory/1844-9-0x000007FEF55B0000-0x000007FEF5F9C000-memory.dmp
        Download

        memory/1844-10-0x0000000000E80000-0x0000000000E81000-memory.dmp
        Download