Overview

overview

8

Static

static

d266c6f4f8...ff.exe

windows7_x64

8

d266c6f4f8...ff.exe

windows10_x64

8

Analysis

  • max time kernel
    140s
  • max time network
    148s
  • platform
    windows10_x64
  • resource
    win10v20201028
  • submitted
    14/12/2020, 20:05

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target
    d266c6f4f8b8404c2d2ebdb8d4065fff.exe
  • Size 502KB
  • Sample201214-36gwfdqvms
  • SHA256 1735709e4b496d80858a5d3cbcf9e7aef536ff439fa04d28be863dd3135dee61
  • MD5 SHA1 SHA512
Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Creates scheduled task(s) 1 TTPs 2 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SendNotifyMessage 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\d266c6f4f8b8404c2d2ebdb8d4065fff.exe
    "C:\Users\Admin\AppData\Local\Temp\d266c6f4f8b8404c2d2ebdb8d4065fff.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:4764
    • C:\Windows\SYSTEM32\schtasks.exe
      "schtasks" /create /tn "Windows Security notification icon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Local\Temp\d266c6f4f8b8404c2d2ebdb8d4065fff.exe" /rl HIGHEST /f
      2⤵
      • Creates scheduled task(s)
      PID:3788
    • C:\Users\Admin\AppData\Roaming\Win32\svchost.exe
      "C:\Users\Admin\AppData\Roaming\Win32\svchost.exe"
      2⤵
      • Executes dropped EXE
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of FindShellTrayWindow
      • Suspicious use of SendNotifyMessage
      • Suspicious use of SetWindowsHookEx
      • Suspicious use of WriteProcessMemory
      PID:4272
      • C:\Windows\SYSTEM32\schtasks.exe
        "schtasks" /create /tn "Windows Security notification icon" /sc ONLOGON /tr "C:\Users\Admin\AppData\Roaming\Win32\svchost.exe" /rl HIGHEST /f
        3⤵
        • Creates scheduled task(s)
        PID:4012

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        memory/4272-9-0x00007FF942830000-0x00007FF94321C000-memory.dmp
        Download

        memory/4272-13-0x000000001BA50000-0x000000001BAF4000-memory.dmp
        Download

        memory/4272-14-0x000000001BE40000-0x000000001BE41000-memory.dmp
        Download

        memory/4272-15-0x000000001CFC0000-0x000000001CFC1000-memory.dmp
        Download

        memory/4764-2-0x00007FF942830000-0x00007FF94321C000-memory.dmp
        Download

        memory/4764-3-0x00000000007A0000-0x00000000007A1000-memory.dmp
        Download