Analysis
-
max time kernel
150s -
max time network
147s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
09-05-2021 16:48
Static task
static1
Behavioral task
behavioral1
Sample
8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe
Resource
win10v20210408
General
-
Target
8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe
-
Size
160KB
-
MD5
bb7975b2ba7ca271e5e75628c4f648ac
-
SHA1
f9741d1c73c53c736fb19e51123f3325db5e9b32
-
SHA256
8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8
-
SHA512
3e73a69972d65dceeb44e01015fd4e3eb5abfce9d0029a2ce54d29248071690337e872de84a396e86291bc12f33ef7769b15f1c257dc87694dfaba21ee5f51bd
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\3E88B2E6 = "C:\\Users\\Admin\\AppData\\Roaming\\3E88B2E6\\bin.exe" winver.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exedescription pid process target process PID 1420 set thread context of 1764 1420 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe 296 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
winver.exeExplorer.EXEpid process 296 winver.exe 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE 1288 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exepid process 1420 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exewinver.exedescription pid process target process PID 1420 wrote to memory of 1764 1420 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe PID 1420 wrote to memory of 1764 1420 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe PID 1420 wrote to memory of 1764 1420 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe PID 1420 wrote to memory of 1764 1420 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe PID 1420 wrote to memory of 1764 1420 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe PID 1420 wrote to memory of 1764 1420 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe PID 1420 wrote to memory of 1764 1420 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe PID 1420 wrote to memory of 1764 1420 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe PID 1764 wrote to memory of 296 1764 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe winver.exe PID 1764 wrote to memory of 296 1764 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe winver.exe PID 1764 wrote to memory of 296 1764 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe winver.exe PID 1764 wrote to memory of 296 1764 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe winver.exe PID 1764 wrote to memory of 296 1764 8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe winver.exe PID 296 wrote to memory of 1288 296 winver.exe Explorer.EXE PID 296 wrote to memory of 1132 296 winver.exe taskhost.exe PID 296 wrote to memory of 1240 296 winver.exe Dwm.exe PID 296 wrote to memory of 1288 296 winver.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe"C:\Users\Admin\AppData\Local\Temp\8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe"C:\Users\Admin\AppData\Local\Temp\8ee8f7beee006e3a8490466b1c92649bdac5f01ebb278fe9481e87f4f865d0a8.exe"3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/296-69-0x0000000000140000-0x0000000000147000-memory.dmpFilesize
28KB
-
memory/296-64-0x0000000000000000-mapping.dmp
-
memory/296-68-0x0000000000940000-0x0000000000956000-memory.dmpFilesize
88KB
-
memory/296-71-0x00000000001C0000-0x00000000001C1000-memory.dmpFilesize
4KB
-
memory/1132-72-0x0000000000210000-0x0000000000217000-memory.dmpFilesize
28KB
-
memory/1240-73-0x00000000001B0000-0x00000000001B7000-memory.dmpFilesize
28KB
-
memory/1288-74-0x0000000002D50000-0x0000000002D57000-memory.dmpFilesize
28KB
-
memory/1288-70-0x0000000002D30000-0x0000000002D37000-memory.dmpFilesize
28KB
-
memory/1288-76-0x00000000770A0000-0x00000000770A1000-memory.dmpFilesize
4KB
-
memory/1288-75-0x00000000770B0000-0x00000000770B1000-memory.dmpFilesize
4KB
-
memory/1288-77-0x0000000077080000-0x0000000077081000-memory.dmpFilesize
4KB
-
memory/1420-61-0x0000000074FB1000-0x0000000074FB3000-memory.dmpFilesize
8KB
-
memory/1764-67-0x00000000007E0000-0x00000000011E0000-memory.dmpFilesize
10.0MB
-
memory/1764-63-0x0000000000401000-mapping.dmp
-
memory/1764-62-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB