Analysis
-
max time kernel
153s -
max time network
154s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
08-05-2021 20:01
Static task
static1
Behavioral task
behavioral1
Sample
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe
Resource
win7v20210408
Behavioral task
behavioral2
Sample
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe
Resource
win10v20210408
General
-
Target
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe
-
Size
136KB
-
MD5
a3b4abc2087d56e6fd7fb3cbcd4a70f8
-
SHA1
374218547142df2072290c5916c7e7641c9697ae
-
SHA256
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959
-
SHA512
d77d767ef0ef449ced7ade15d601ef73fbcdeb1cdad28a0ef8aa7e608e2e2e8597192f413abda4ab4aabe0b0ef147fd644062da831f0ce3c5499e2f4af6d47f0
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-2455352368-1077083310-2879168483-1000\Software\Microsoft\Windows\CurrentVersion\Run\9993B101 = "C:\\Users\\Admin\\AppData\\Roaming\\9993B101\\bin.exe" winver.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exedescription pid process target process PID 1816 set thread context of 1944 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exewinver.exepid process 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe 472 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
winver.exeExplorer.EXEpid process 472 winver.exe 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE 1212 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exepid process 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exebeaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exewinver.exedescription pid process target process PID 1816 wrote to memory of 1944 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 1816 wrote to memory of 1944 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 1816 wrote to memory of 1944 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 1816 wrote to memory of 1944 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 1816 wrote to memory of 1944 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 1816 wrote to memory of 1944 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 1816 wrote to memory of 1944 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 1816 wrote to memory of 1944 1816 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe PID 1944 wrote to memory of 472 1944 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe winver.exe PID 1944 wrote to memory of 472 1944 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe winver.exe PID 1944 wrote to memory of 472 1944 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe winver.exe PID 1944 wrote to memory of 472 1944 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe winver.exe PID 1944 wrote to memory of 472 1944 beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe winver.exe PID 472 wrote to memory of 1212 472 winver.exe Explorer.EXE PID 472 wrote to memory of 1104 472 winver.exe taskhost.exe PID 472 wrote to memory of 1180 472 winver.exe Dwm.exe PID 472 wrote to memory of 1212 472 winver.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe"C:\Users\Admin\AppData\Local\Temp\beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exeC:\Users\Admin\AppData\Local\Temp\beaeb6f3d0bcfe5a01a74cfd3b6de9836edea01c46e2d8fba9a55eb596645959.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/472-69-0x0000000000090000-0x0000000000096000-memory.dmpFilesize
24KB
-
memory/472-68-0x0000000000750000-0x0000000000766000-memory.dmpFilesize
88KB
-
memory/472-75-0x00000000001F0000-0x00000000001F6000-memory.dmpFilesize
24KB
-
memory/472-71-0x00000000000D0000-0x00000000000D1000-memory.dmpFilesize
4KB
-
memory/472-64-0x0000000000000000-mapping.dmp
-
memory/1104-72-0x0000000000210000-0x0000000000216000-memory.dmpFilesize
24KB
-
memory/1180-73-0x0000000000120000-0x0000000000126000-memory.dmpFilesize
24KB
-
memory/1212-76-0x0000000076FF0000-0x0000000076FF1000-memory.dmpFilesize
4KB
-
memory/1212-74-0x0000000003B70000-0x0000000003B76000-memory.dmpFilesize
24KB
-
memory/1212-78-0x0000000076FD0000-0x0000000076FD1000-memory.dmpFilesize
4KB
-
memory/1212-77-0x0000000076FE0000-0x0000000076FE1000-memory.dmpFilesize
4KB
-
memory/1212-70-0x0000000003B60000-0x0000000003B66000-memory.dmpFilesize
24KB
-
memory/1816-60-0x0000000074D91000-0x0000000074D93000-memory.dmpFilesize
8KB
-
memory/1816-62-0x0000000000250000-0x0000000000254000-memory.dmpFilesize
16KB
-
memory/1944-66-0x0000000000400000-0x0000000000404400-memory.dmpFilesize
17KB
-
memory/1944-63-0x0000000000401000-mapping.dmp
-
memory/1944-67-0x00000000017D0000-0x00000000021D0000-memory.dmpFilesize
10.0MB
-
memory/1944-61-0x0000000000400000-0x000000000149A000-memory.dmpFilesize
16.6MB