Overview

overview

5

Static

static

Booking.exe

windows7_x64

5

Booking.exe

windows10_x64

5

Analysis

  • max time kernel
    98s
  • max time network
    9s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    13-01-2021 07:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Booking.exe

  • Size

    760KB

  • MD5

    be4013ed4e9fc8135904614cc4cba168

  • SHA1

    bdebf68b92cc39ed4c6013f69dafefcdd09385d3

  • SHA256

    450f7d91e80c562310d464e2d0cebaa1ca6e0c475b29dda096fdeee69343701d

  • SHA512

    c0702434f0888e19a281412ce69eaec88b5cef8a0b551071e0ddf3c6e47113319e69ee0b2c303db2c3b5e19ec85189e21b2daca8a2fc661063f4c25141282861

Score
5/10

Malware Config

Signatures

  • Suspicious use of SetThreadContext 1 IoCs
  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious use of AdjustPrivilegeToken 2 IoCs
  • Suspicious use of WriteProcessMemory 17 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\Booking.exe
    "C:\Users\Admin\AppData\Local\Temp\Booking.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1824
    • C:\Windows\SysWOW64\schtasks.exe
      "C:\Windows\System32\schtasks.exe" /Create /TN "Updates\TvNoaLvRBhpKuQ" /XML "C:\Users\Admin\AppData\Local\Temp\tmpE2A1.tmp"
      2⤵
      • Creates scheduled task(s)
      PID:852
    • C:\Users\Admin\AppData\Local\Temp\Booking.exe
      "C:\Users\Admin\AppData\Local\Temp\Booking.exe"
      2⤵
        PID:596
      • C:\Users\Admin\AppData\Local\Temp\Booking.exe
        "C:\Users\Admin\AppData\Local\Temp\Booking.exe"
        2⤵
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious use of AdjustPrivilegeToken
        PID:1640

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • C:\Users\Admin\AppData\Local\Temp\tmpE2A1.tmp
      MD5

      8a0154abb93062e9701f52742db6ce19

      SHA1

      6de069904173f1e2ffb6c809b901d155708720b6

      SHA256

      3a4de07df3c33182b67232d7f904baf96cda580cabd3ab69852163daf4ccf8e3

      SHA512

      e9addb3ac474b43c23e66b0e017e893b98a6e5428f39a00a3d23499eb4b85c3c1be5ed4372eb3b068b95d9ed3a21aa7103db6c3dce87750cf9635ca7c47a353b

      Download Submit
    • memory/852-7-0x0000000000000000-mapping.dmp
      Download
    • memory/1640-10-0x000000000043764E-mapping.dmp
      Download
    • memory/1640-9-0x0000000000400000-0x0000000000440000-memory.dmp
      Filesize

      256KB

      Download
    • memory/1640-12-0x0000000000400000-0x0000000000440000-memory.dmp
      Filesize

      256KB

      Download
    • memory/1640-11-0x0000000000400000-0x0000000000440000-memory.dmp
      Filesize

      256KB

      Download
    • memory/1640-13-0x0000000072D60000-0x000000007344E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/1824-2-0x0000000073980000-0x000000007406E000-memory.dmp
      Filesize

      6.9MB

      Download
    • memory/1824-3-0x0000000000980000-0x0000000000981000-memory.dmp
      Filesize

      4KB

      Download
    • memory/1824-5-0x0000000000590000-0x00000000005A2000-memory.dmp
      Filesize

      72KB

      Download
    • memory/1824-6-0x0000000005500000-0x000000000557A000-memory.dmp
      Filesize

      488KB

      Download