Overview

overview

10

Static

static

8

0032588b8d...091.js

windows7_x64

1

0032588b8d...091.js

windows10_x64

1

09002c686e...2b.exe

windows7_x64

10

09002c686e...2b.exe

windows10_x64

10

0b1551c0be...16.exe

windows7_x64

1

0b1551c0be...16.exe

windows10_x64

1

1048caa70a...29.exe

windows7_x64

10

1048caa70a...29.exe

windows10_x64

10

1c3170b776...b0.exe

windows7_x64

3

1c3170b776...b0.exe

windows10_x64

3

240387329d...62.exe

windows7_x64

1

240387329d...62.exe

windows10_x64

1

2573b35645...9a.exe

windows7_x64

10

2573b35645...9a.exe

windows10_x64

10

2df6c36b47...51.exe

windows7_x64

7

2df6c36b47...51.exe

windows10_x64

7

2df6c36b47...1).exe

windows7_x64

7

2df6c36b47...1).exe

windows10_x64

7

2e4319ff62...8b.dll

windows7_x64

1

2e4319ff62...8b.dll

windows10_x64

3

2fba2aba4b...07.exe

windows7_x64

1

2fba2aba4b...07.exe

windows10_x64

1

3ed5d687a4...bd.exe

windows7_x64

3

3ed5d687a4...bd.exe

windows10_x64

3

4fc17a5cf8...d5.exe

windows7_x64

6

4fc17a5cf8...d5.exe

windows10_x64

6

5942a02bc0...d3.dll

windows7_x64

10

5942a02bc0...d3.dll

windows10_x64

10

6e7785213d...3d.exe

windows7_x64

8

6e7785213d...3d.exe

windows10_x64

8

83c64ed85d...a0.exe

windows7_x64

10

83c64ed85d...a0.exe

windows10_x64

10

Analysis

  • max time kernel
    150s
  • max time network
    149s
  • platform
    windows7_x64
  • resource
    win7v20201028
  • submitted
    15-03-2021 09:51

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    6e7785213d6af20f376a909c1ecb6c9bddec70049764f08e5054a52997241e3d.exe

  • Size

    117KB

  • MD5

    31963075abec1ca51a7c8416baf097f2

  • SHA1

    44b5e306c4b3af5c7819eaef7b13a3560ecaefac

  • SHA256

    6e7785213d6af20f376a909c1ecb6c9bddec70049764f08e5054a52997241e3d

  • SHA512

    44b0eea2e51040c3e93b8a8935ce95d277ba195543fa345e849c894ebff22bbc4eadbb0dee504c8d39e70441bf4a19ce9ecd87cdd6c2d7997ddc33bcc6f06f56

Score
8/10
persistence

Malware Config

Signatures

  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of FindShellTrayWindow 55 IoCs
  • Suspicious use of SendNotifyMessage 55 IoCs
  • Suspicious use of WriteProcessMemory 4 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\6e7785213d6af20f376a909c1ecb6c9bddec70049764f08e5054a52997241e3d.exe
    "C:\Users\Admin\AppData\Local\Temp\6e7785213d6af20f376a909c1ecb6c9bddec70049764f08e5054a52997241e3d.exe"
    1⤵
    • Maps connected drives based on registry
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    • Suspicious use of WriteProcessMemory
    PID:1676
    • C:\Windows\SysWOW64\explorer.exe
      explorer.exe
      2⤵
      • Adds policy Run key to start application
      • Deletes itself
      PID:1428

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/1428-120-0x00000000746D1000-0x00000000746D3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1428-122-0x00000000000C0000-0x00000000000CE000-memory.dmp

    Filesize

    56KB

    Download

  • memory/1428-121-0x0000000000ED0000-0x0000000001151000-memory.dmp

    Filesize

    2.5MB

    Download

  • memory/1676-2-0x0000000075F21000-0x0000000075F23000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1676-3-0x00000000021D0000-0x00000000021FA000-memory.dmp

    Filesize

    168KB

    Download

  • memory/1676-4-0x00000000003F0000-0x00000000003F1000-memory.dmp

    Filesize

    4KB

    Download

  • memory/1676-105-0x0000000000490000-0x000000000049E000-memory.dmp

    Filesize

    56KB

    Download