Overview

overview

10

Static

static

[email protected]

windows7_x64

10

[email protected]

windows10_x64

8

Analysis

  • max time kernel
    51s
  • max time network
    131s
  • platform
    windows10_x64
  • resource
    win10v20210408
  • submitted
    14/04/2021, 06:42

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    [email protected]

  • Size

    1.3MB

  • MD5

    645d774a869c582b2c46beed455321d4

  • SHA1

    e94862c25377373f54ce668051df0d95d3746514

  • SHA256

    21420b8630260dae7f0ea14a319a8b3ae6910def98599109b365f710e835b9c4

  • SHA512

    2c7cc053ed79e52f7e2ae508d2d832e6efa0b9a24dc71158fbc25d829c3d9ad8aa8f5c04e7fff94152dacc04cc1d7604da147ee201d900efcbcc62fe95f15b81

Score
8/10
evasion

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs
    evasion
  • Drops desktop.ini file(s) 7 IoCs
  • Drops file in Program Files directory 64 IoCs
  • NTFS ADS 2 IoCs
  • Runs net.exe
  • Suspicious behavior: EnumeratesProcesses 18 IoCs
  • Suspicious use of WriteProcessMemory 64 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\[email protected]
    "C:\Users\Admin\AppData\Local\Temp\[email protected]"
    1⤵
    • Drops desktop.ini file(s)
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of WriteProcessMemory
    PID:1000
    • C:\Windows\SysWOW64\cmd.exe
      C:\Windows\system32\cmd.exe /c net stop MSDTC
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:2548
      • C:\Windows\SysWOW64\net.exe
        net stop MSDTC
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:3540
        • C:\Windows\SysWOW64\net1.exe
          C:\Windows\system32\net1 stop MSDTC
          4⤵
            PID:636
      • C:\Windows\SysWOW64\cmd.exe
        C:\Windows\system32\cmd.exe /c bcdedit /set {default} bootstatuspolicy ignoreallfailures
        2⤵
          PID:3000
        • C:\Windows\SysWOW64\cmd.exe
          C:\Windows\system32\cmd.exe /c bcdedit /set {default} recoveryenabled no
          2⤵
            PID:3028
          • C:\Windows\SysWOW64\cmd.exe
            C:\Windows\system32\cmd.exe /c wbadmin delete catalog -quiet
            2⤵
              PID:1196
            • C:\Windows\SysWOW64\cmd.exe
              C:\Windows\system32\cmd.exe /c net stop SQLSERVERAGENT
              2⤵
              • Suspicious use of WriteProcessMemory
              PID:3716
              • C:\Windows\SysWOW64\net.exe
                net stop SQLSERVERAGENT
                3⤵
                • Suspicious use of WriteProcessMemory
                PID:3892
                • C:\Windows\SysWOW64\net1.exe
                  C:\Windows\system32\net1 stop SQLSERVERAGENT
                  4⤵
                    PID:1016
              • C:\Windows\SysWOW64\cmd.exe
                C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                2⤵
                • Suspicious use of WriteProcessMemory
                PID:3184
                • C:\Windows\SysWOW64\net.exe
                  net stop MSSQLSERVER
                  3⤵
                  • Suspicious use of WriteProcessMemory
                  PID:2560
                  • C:\Windows\SysWOW64\net1.exe
                    C:\Windows\system32\net1 stop MSSQLSERVER
                    4⤵
                      PID:2880
                • C:\Windows\SysWOW64\cmd.exe
                  C:\Windows\system32\cmd.exe /c net stop vds
                  2⤵
                  • Suspicious use of WriteProcessMemory
                  PID:204
                  • C:\Windows\SysWOW64\net.exe
                    net stop vds
                    3⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1588
                    • C:\Windows\SysWOW64\net1.exe
                      C:\Windows\system32\net1 stop vds
                      4⤵
                        PID:2908
                  • C:\Windows\SysWOW64\cmd.exe
                    C:\Windows\system32\cmd.exe /c netsh advfirewall set currentprofile state off
                    2⤵
                    • Suspicious use of WriteProcessMemory
                    PID:1308
                    • C:\Windows\SysWOW64\netsh.exe
                      netsh advfirewall set currentprofile state off
                      3⤵
                        PID:2700
                    • C:\Windows\SysWOW64\cmd.exe
                      C:\Windows\system32\cmd.exe /c netsh firewall set opmode mode=disable
                      2⤵
                      • Suspicious use of WriteProcessMemory
                      PID:3176
                      • C:\Windows\SysWOW64\netsh.exe
                        netsh firewall set opmode mode=disable
                        3⤵
                          PID:1196
                      • C:\Windows\SysWOW64\cmd.exe
                        C:\Windows\system32\cmd.exe /c net stop SQLWriter
                        2⤵
                        • Suspicious use of WriteProcessMemory
                        PID:3924
                        • C:\Windows\SysWOW64\net.exe
                          net stop SQLWriter
                          3⤵
                          • Suspicious use of WriteProcessMemory
                          PID:2136
                          • C:\Windows\SysWOW64\net1.exe
                            C:\Windows\system32\net1 stop SQLWriter
                            4⤵
                              PID:2608
                        • C:\Windows\SysWOW64\cmd.exe
                          C:\Windows\system32\cmd.exe /c net stop SQLBrowser
                          2⤵
                            PID:3828
                            • C:\Windows\SysWOW64\net.exe
                              net stop SQLBrowser
                              3⤵
                                PID:3184
                                • C:\Windows\SysWOW64\net1.exe
                                  C:\Windows\system32\net1 stop SQLBrowser
                                  4⤵
                                    PID:2664
                              • C:\Windows\SysWOW64\cmd.exe
                                C:\Windows\system32\cmd.exe /c net stop MSSQLSERVER
                                2⤵
                                  PID:3452
                                  • C:\Windows\SysWOW64\net.exe
                                    net stop MSSQLSERVER
                                    3⤵
                                      PID:2888
                                      • C:\Windows\SysWOW64\net1.exe
                                        C:\Windows\system32\net1 stop MSSQLSERVER
                                        4⤵
                                          PID:3420
                                    • C:\Windows\SysWOW64\cmd.exe
                                      C:\Windows\system32\cmd.exe /c net stop MSSQL$CONTOSO1
                                      2⤵
                                        PID:1328
                                        • C:\Windows\SysWOW64\net.exe
                                          net stop MSSQL$CONTOSO1
                                          3⤵
                                            PID:1492
                                            • C:\Windows\SysWOW64\net1.exe
                                              C:\Windows\system32\net1 stop MSSQL$CONTOSO1
                                              4⤵
                                                PID:3548

                                        Network

                                        MITRE ATT&CK Enterprise v6

                                        Replay Monitor

                                        Loading Replay Monitor...

                                        Downloads