Analysis
-
max time kernel
150s -
max time network
149s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 13:29
Static task
static1
Behavioral task
behavioral1
Sample
e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe
Resource
win10v20210410
General
-
Target
e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe
-
Size
98KB
-
MD5
b051edf677d794088e2ebcea7ac8584b
-
SHA1
87a5b5aa6b06450ed2577a954c16cbc4841e4e03
-
SHA256
e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a
-
SHA512
2bf5af01c3a1afa5eca839bdad0fa9ac0cd87466ce29cde52469843d262fcee4b9712d4478bfd9bec855d8f5b968720f6b3d4891683b5093a46560098d2f9771
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\9CD59E03 = "C:\\Users\\Admin\\AppData\\Roaming\\9CD59E03\\bin.exe" winver.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exedescription pid process target process PID 1056 set thread context of 1840 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exewinver.exepid process 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe 1756 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
winver.exeExplorer.EXEpid process 1756 winver.exe 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE 1200 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exepid process 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exee6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exewinver.exedescription pid process target process PID 1056 wrote to memory of 1840 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe PID 1056 wrote to memory of 1840 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe PID 1056 wrote to memory of 1840 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe PID 1056 wrote to memory of 1840 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe PID 1056 wrote to memory of 1840 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe PID 1056 wrote to memory of 1840 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe PID 1056 wrote to memory of 1840 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe PID 1056 wrote to memory of 1840 1056 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe PID 1840 wrote to memory of 1756 1840 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe winver.exe PID 1840 wrote to memory of 1756 1840 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe winver.exe PID 1840 wrote to memory of 1756 1840 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe winver.exe PID 1840 wrote to memory of 1756 1840 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe winver.exe PID 1840 wrote to memory of 1756 1840 e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe winver.exe PID 1756 wrote to memory of 1200 1756 winver.exe Explorer.EXE PID 1756 wrote to memory of 1116 1756 winver.exe taskhost.exe PID 1756 wrote to memory of 1172 1756 winver.exe Dwm.exe PID 1756 wrote to memory of 1200 1756 winver.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe"C:\Users\Admin\AppData\Local\Temp\e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exeC:\Users\Admin\AppData\Local\Temp\e6a7c4c68f583b72e1ca2bbf763202a91f2f27ac94824ee12725c913a9bc290a.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1056-63-0x00000000003A0000-0x00000000003A4000-memory.dmpFilesize
16KB
-
memory/1056-60-0x00000000766D1000-0x00000000766D3000-memory.dmpFilesize
8KB
-
memory/1116-72-0x0000000000150000-0x0000000000156000-memory.dmpFilesize
24KB
-
memory/1172-73-0x00000000001A0000-0x00000000001A6000-memory.dmpFilesize
24KB
-
memory/1200-71-0x0000000002B40000-0x0000000002B46000-memory.dmpFilesize
24KB
-
memory/1200-77-0x00000000777A0000-0x00000000777A1000-memory.dmpFilesize
4KB
-
memory/1200-75-0x00000000777C0000-0x00000000777C1000-memory.dmpFilesize
4KB
-
memory/1200-76-0x00000000777B0000-0x00000000777B1000-memory.dmpFilesize
4KB
-
memory/1200-74-0x0000000002B50000-0x0000000002B56000-memory.dmpFilesize
24KB
-
memory/1756-64-0x0000000000000000-mapping.dmp
-
memory/1756-69-0x0000000000090000-0x0000000000096000-memory.dmpFilesize
24KB
-
memory/1756-70-0x0000000000190000-0x0000000000191000-memory.dmpFilesize
4KB
-
memory/1756-68-0x0000000000410000-0x0000000000426000-memory.dmpFilesize
88KB
-
memory/1840-67-0x0000000001630000-0x0000000002030000-memory.dmpFilesize
10.0MB
-
memory/1840-66-0x0000000000400000-0x0000000000404400-memory.dmpFilesize
17KB
-
memory/1840-61-0x0000000000400000-0x000000000149A000-memory.dmpFilesize
16.6MB
-
memory/1840-62-0x0000000000401000-mapping.dmp