Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
08-05-2021 21:53
Static task
static1
Behavioral task
behavioral1
Sample
73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe
Resource
win10v20210410
General
-
Target
73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe
-
Size
98KB
-
MD5
cfb0c225c8c8da011cfebcc5d4572612
-
SHA1
51e7348adf6ec378fcaaf09effda78cc32f11ff4
-
SHA256
73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b
-
SHA512
2294e69281b5822e52c2b56b50fda51863c43426dfe2aec836281d648188a8452da3e46810fd4710803dafb21d3e1dcf4729265aa06f4a1d8eb7c05d9ebea659
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\1FAFA4C6 = "C:\\Users\\Admin\\AppData\\Roaming\\1FAFA4C6\\bin.exe" winver.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exedescription pid process target process PID 1088 set thread context of 1892 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exewinver.exepid process 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe 1740 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
winver.exeExplorer.EXEpid process 1740 winver.exe 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exepid process 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exewinver.exedescription pid process target process PID 1088 wrote to memory of 1892 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe PID 1088 wrote to memory of 1892 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe PID 1088 wrote to memory of 1892 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe PID 1088 wrote to memory of 1892 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe PID 1088 wrote to memory of 1892 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe PID 1088 wrote to memory of 1892 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe PID 1088 wrote to memory of 1892 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe PID 1088 wrote to memory of 1892 1088 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe PID 1892 wrote to memory of 1740 1892 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe winver.exe PID 1892 wrote to memory of 1740 1892 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe winver.exe PID 1892 wrote to memory of 1740 1892 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe winver.exe PID 1892 wrote to memory of 1740 1892 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe winver.exe PID 1892 wrote to memory of 1740 1892 73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe winver.exe PID 1740 wrote to memory of 1264 1740 winver.exe Explorer.EXE PID 1740 wrote to memory of 1124 1740 winver.exe taskhost.exe PID 1740 wrote to memory of 1232 1740 winver.exe Dwm.exe PID 1740 wrote to memory of 1264 1740 winver.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe"C:\Users\Admin\AppData\Local\Temp\73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exeC:\Users\Admin\AppData\Local\Temp\73b82bf5ee75eeefd41d3873518fa24081da9570e5018fa61f1e5f91291bba9b.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1088-62-0x00000000002C0000-0x00000000002C4000-memory.dmpFilesize
16KB
-
memory/1088-59-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/1124-71-0x0000000001BC0000-0x0000000001BC6000-memory.dmpFilesize
24KB
-
memory/1232-72-0x0000000000120000-0x0000000000126000-memory.dmpFilesize
24KB
-
memory/1264-70-0x0000000002A40000-0x0000000002A46000-memory.dmpFilesize
24KB
-
memory/1264-76-0x0000000077530000-0x0000000077531000-memory.dmpFilesize
4KB
-
memory/1264-74-0x0000000077560000-0x0000000077561000-memory.dmpFilesize
4KB
-
memory/1264-75-0x0000000077550000-0x0000000077551000-memory.dmpFilesize
4KB
-
memory/1264-73-0x0000000002A50000-0x0000000002A56000-memory.dmpFilesize
24KB
-
memory/1740-69-0x0000000000210000-0x0000000000211000-memory.dmpFilesize
4KB
-
memory/1740-68-0x0000000000150000-0x0000000000156000-memory.dmpFilesize
24KB
-
memory/1740-67-0x0000000000580000-0x0000000000596000-memory.dmpFilesize
88KB
-
memory/1740-65-0x0000000000000000-mapping.dmp
-
memory/1892-64-0x0000000001510000-0x0000000001F10000-memory.dmpFilesize
10.0MB
-
memory/1892-63-0x0000000000400000-0x0000000000404400-memory.dmpFilesize
17KB
-
memory/1892-61-0x0000000000401000-mapping.dmp
-
memory/1892-60-0x0000000000400000-0x000000000149A000-memory.dmpFilesize
16.6MB