Analysis
-
max time kernel
77s -
max time network
99s -
platform
windows10_x64 -
resource
win10v20201028 -
submitted
13-01-2021 20:20
Static task
static1
Behavioral task
behavioral1
Sample
121.exe
Resource
win7v20201028
Behavioral task
behavioral2
Sample
121.exe
Resource
win10v20201028
General
-
Target
121.exe
-
Size
3.6MB
-
MD5
efb2808e93c3f53bdc896c2957cc9b87
-
SHA1
82fa8aa8a75a1194232ec186bb73266f7b76d56f
-
SHA256
3864000bdce54306e787beb73fbb02642f7a539a2c255fc6e76dcbe2e685c733
-
SHA512
9db24f6bac562b27512583362f00082d14aeb20a6dd10356c6fc154ef467ae1121bf317e782d017f16e7b7e8cbd1859d82494308c2bfb5b3ff5975c53c0cd6c2
Malware Config
Signatures
-
Executes dropped EXE 4 IoCs
Processes:
InstallUtil.exeInstallUtil.exeInstallUtil.exefile.exepid process 3664 InstallUtil.exe 3948 InstallUtil.exe 204 InstallUtil.exe 1632 file.exe -
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
reg.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run reg.exe Set value (str) \REGISTRY\USER\S-1-5-21-3341490333-719741536-2920803124-1000\Software\Microsoft\Windows\CurrentVersion\Run\file = "C:\\Users\\Admin\\Documents\\file.exe" reg.exe -
Suspicious use of SetThreadContext 3 IoCs
Processes:
121.exeInstallUtil.exeInstallUtil.exedescription pid process target process PID 1156 set thread context of 3664 1156 121.exe InstallUtil.exe PID 3664 set thread context of 3948 3664 InstallUtil.exe InstallUtil.exe PID 3948 set thread context of 204 3948 InstallUtil.exe InstallUtil.exe -
Suspicious behavior: EnumeratesProcesses 21 IoCs
Processes:
121.exeInstallUtil.exeInstallUtil.exeInstallUtil.exepid process 1156 121.exe 1156 121.exe 3664 InstallUtil.exe 3664 InstallUtil.exe 3948 InstallUtil.exe 3948 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe 204 InstallUtil.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
121.exeInstallUtil.exeInstallUtil.exeInstallUtil.exedescription pid process Token: SeDebugPrivilege 1156 121.exe Token: SeDebugPrivilege 3664 InstallUtil.exe Token: SeDebugPrivilege 3948 InstallUtil.exe Token: SeDebugPrivilege 204 InstallUtil.exe -
Suspicious use of WriteProcessMemory 33 IoCs
Processes:
121.exeInstallUtil.exeInstallUtil.exeInstallUtil.execmd.exedescription pid process target process PID 1156 wrote to memory of 3664 1156 121.exe InstallUtil.exe PID 1156 wrote to memory of 3664 1156 121.exe InstallUtil.exe PID 1156 wrote to memory of 3664 1156 121.exe InstallUtil.exe PID 1156 wrote to memory of 3664 1156 121.exe InstallUtil.exe PID 1156 wrote to memory of 3664 1156 121.exe InstallUtil.exe PID 1156 wrote to memory of 3664 1156 121.exe InstallUtil.exe PID 1156 wrote to memory of 3664 1156 121.exe InstallUtil.exe PID 1156 wrote to memory of 3664 1156 121.exe InstallUtil.exe PID 3664 wrote to memory of 3948 3664 InstallUtil.exe InstallUtil.exe PID 3664 wrote to memory of 3948 3664 InstallUtil.exe InstallUtil.exe PID 3664 wrote to memory of 3948 3664 InstallUtil.exe InstallUtil.exe PID 3664 wrote to memory of 3948 3664 InstallUtil.exe InstallUtil.exe PID 3664 wrote to memory of 3948 3664 InstallUtil.exe InstallUtil.exe PID 3664 wrote to memory of 3948 3664 InstallUtil.exe InstallUtil.exe PID 3664 wrote to memory of 3948 3664 InstallUtil.exe InstallUtil.exe PID 3664 wrote to memory of 3948 3664 InstallUtil.exe InstallUtil.exe PID 3948 wrote to memory of 204 3948 InstallUtil.exe InstallUtil.exe PID 3948 wrote to memory of 204 3948 InstallUtil.exe InstallUtil.exe PID 3948 wrote to memory of 204 3948 InstallUtil.exe InstallUtil.exe PID 3948 wrote to memory of 204 3948 InstallUtil.exe InstallUtil.exe PID 3948 wrote to memory of 204 3948 InstallUtil.exe InstallUtil.exe PID 3948 wrote to memory of 204 3948 InstallUtil.exe InstallUtil.exe PID 3948 wrote to memory of 204 3948 InstallUtil.exe InstallUtil.exe PID 3948 wrote to memory of 204 3948 InstallUtil.exe InstallUtil.exe PID 204 wrote to memory of 3052 204 InstallUtil.exe cmd.exe PID 204 wrote to memory of 3052 204 InstallUtil.exe cmd.exe PID 204 wrote to memory of 3052 204 InstallUtil.exe cmd.exe PID 3052 wrote to memory of 2040 3052 cmd.exe reg.exe PID 3052 wrote to memory of 2040 3052 cmd.exe reg.exe PID 3052 wrote to memory of 2040 3052 cmd.exe reg.exe PID 204 wrote to memory of 1632 204 InstallUtil.exe file.exe PID 204 wrote to memory of 1632 204 InstallUtil.exe file.exe PID 204 wrote to memory of 1632 204 InstallUtil.exe file.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\121.exe"C:\Users\Admin\AppData\Local\Temp\121.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"2⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"3⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"C:\Users\Admin\AppData\Local\Temp\InstallUtil.exe"4⤵
- Executes dropped EXE
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\cmd.exe"cmd.exe" /c REG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "file" /t REG_SZ /d "C:\Users\Admin\Documents\file.exe"5⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\reg.exeREG ADD "HKCU\Software\Microsoft\Windows\CurrentVersion\Run" /f /v "file" /t REG_SZ /d "C:\Users\Admin\Documents\file.exe"6⤵
- Adds Run key to start application
-
C:\Users\Admin\Documents\file.exe"C:\Users\Admin\Documents\file.exe"5⤵
- Executes dropped EXE
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\InstallUtil.exe.logMD5
c820f09a0724473fd6684dd8b9c64fb1
SHA1942b2f32ba228d7b94dbcf4ab070a42dc9f32e2e
SHA2567e1b78804f89cd762348a40693f64baa0a4b862eddfc0b9d2cc76468800bd1cf
SHA512d13768677837673826302113e280bb1e9241b0000028e0709bc07fa59dce393ed9f828aa761349e89c0ebedfbac78723dac376bb00b0e2b8707b2379163ce907
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\AppData\Local\Temp\InstallUtil.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\Documents\file.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
C:\Users\Admin\Documents\file.exeMD5
91c9ae9c9a17a9db5e08b120e668c74c
SHA150770954c1ceb0bb6f1d5d3f2de2a0a065773723
SHA256e56a7e5d3ab9675555e2897fc3faa2dd9265008a4967a7d54030ab8184d2d38f
SHA512ca504af192e3318359d4742a2ef26ae1b5d040a4f9942782e02549a310158d5d5dbf919b4c748c31ee609d2046bd23ee0c22712891c86ae4a1e3a58c6e67647e
-
memory/204-40-0x0000000073CC0000-0x00000000743AE000-memory.dmpFilesize
6.9MB
-
memory/204-38-0x000000000045C4DE-mapping.dmp
-
memory/204-37-0x0000000000400000-0x0000000000462000-memory.dmpFilesize
392KB
-
memory/1156-10-0x0000000004D10000-0x0000000004D11000-memory.dmpFilesize
4KB
-
memory/1156-5-0x0000000005200000-0x0000000005201000-memory.dmpFilesize
4KB
-
memory/1156-3-0x00000000004A0000-0x00000000004A1000-memory.dmpFilesize
4KB
-
memory/1156-2-0x0000000073CB0000-0x000000007439E000-memory.dmpFilesize
6.9MB
-
memory/1156-9-0x0000000004CF0000-0x0000000004CFB000-memory.dmpFilesize
44KB
-
memory/1156-8-0x0000000007B70000-0x0000000007B71000-memory.dmpFilesize
4KB
-
memory/1156-7-0x0000000002C40000-0x0000000002C41000-memory.dmpFilesize
4KB
-
memory/1156-6-0x0000000000EE0000-0x0000000000EFE000-memory.dmpFilesize
120KB
-
memory/1632-54-0x0000000001120000-0x0000000001121000-memory.dmpFilesize
4KB
-
memory/1632-53-0x0000000000880000-0x0000000000881000-memory.dmpFilesize
4KB
-
memory/1632-52-0x0000000073D50000-0x000000007443E000-memory.dmpFilesize
6.9MB
-
memory/1632-49-0x0000000000000000-mapping.dmp
-
memory/2040-48-0x0000000000000000-mapping.dmp
-
memory/3052-47-0x0000000000000000-mapping.dmp
-
memory/3664-15-0x0000000073CB0000-0x000000007439E000-memory.dmpFilesize
6.9MB
-
memory/3664-12-0x00000000005E59CE-mapping.dmp
-
memory/3664-16-0x0000000000600000-0x00000000007EA000-memory.dmpFilesize
1.9MB
-
memory/3948-28-0x0000000073CC0000-0x00000000743AE000-memory.dmpFilesize
6.9MB
-
memory/3948-25-0x00000000004E2CAE-mapping.dmp
-
memory/3948-24-0x0000000000400000-0x00000000004E8000-memory.dmpFilesize
928KB