Analysis
-
max time kernel
150s -
max time network
146s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
11-05-2021 15:05
Static task
static1
Behavioral task
behavioral1
Sample
aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe
Resource
win10v20210410
General
-
Target
aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe
-
Size
98KB
-
MD5
e8260ec52025c1d563a76f33328b50ac
-
SHA1
e40c4b859f8ee266a0ed913e13ca47823fead1c4
-
SHA256
aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6
-
SHA512
8b3d941e312187be624ebd1b05ce3f206df1e8b35a19491ef59596c5081dbdc8beb3b390a5fbac9de26c7ddc12d627ce8475c08b288bbf7d062b7061e6c58e60
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\5BD7BD15 = "C:\\Users\\Admin\\AppData\\Roaming\\5BD7BD15\\bin.exe" winver.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exedescription pid process target process PID 1088 set thread context of 1968 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exewinver.exepid process 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe 1752 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
winver.exeExplorer.EXEpid process 1752 winver.exe 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exepid process 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exeaa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exewinver.exedescription pid process target process PID 1088 wrote to memory of 1968 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe PID 1088 wrote to memory of 1968 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe PID 1088 wrote to memory of 1968 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe PID 1088 wrote to memory of 1968 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe PID 1088 wrote to memory of 1968 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe PID 1088 wrote to memory of 1968 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe PID 1088 wrote to memory of 1968 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe PID 1088 wrote to memory of 1968 1088 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe PID 1968 wrote to memory of 1752 1968 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe winver.exe PID 1968 wrote to memory of 1752 1968 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe winver.exe PID 1968 wrote to memory of 1752 1968 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe winver.exe PID 1968 wrote to memory of 1752 1968 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe winver.exe PID 1968 wrote to memory of 1752 1968 aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe winver.exe PID 1752 wrote to memory of 1264 1752 winver.exe Explorer.EXE PID 1752 wrote to memory of 1124 1752 winver.exe taskhost.exe PID 1752 wrote to memory of 1232 1752 winver.exe Dwm.exe PID 1752 wrote to memory of 1264 1752 winver.exe Explorer.EXE
Processes
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
-
C:\Users\Admin\AppData\Local\Temp\aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe"C:\Users\Admin\AppData\Local\Temp\aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exeC:\Users\Admin\AppData\Local\Temp\aa10413b9e88d44e8eb76087d44e6ab5042db40def75108e5fe7dd6d2772c3a6.exe3⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1088-62-0x00000000002E0000-0x00000000002E4000-memory.dmpFilesize
16KB
-
memory/1088-60-0x00000000753B1000-0x00000000753B3000-memory.dmpFilesize
8KB
-
memory/1124-72-0x0000000001BC0000-0x0000000001BC6000-memory.dmpFilesize
24KB
-
memory/1232-73-0x0000000000120000-0x0000000000126000-memory.dmpFilesize
24KB
-
memory/1264-71-0x0000000002A30000-0x0000000002A36000-memory.dmpFilesize
24KB
-
memory/1264-77-0x0000000077530000-0x0000000077531000-memory.dmpFilesize
4KB
-
memory/1264-75-0x0000000077560000-0x0000000077561000-memory.dmpFilesize
4KB
-
memory/1264-76-0x0000000077550000-0x0000000077551000-memory.dmpFilesize
4KB
-
memory/1264-74-0x0000000002A40000-0x0000000002A46000-memory.dmpFilesize
24KB
-
memory/1752-64-0x0000000000000000-mapping.dmp
-
memory/1752-69-0x0000000000140000-0x0000000000146000-memory.dmpFilesize
24KB
-
memory/1752-70-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1752-68-0x00000000008B0000-0x00000000008C6000-memory.dmpFilesize
88KB
-
memory/1968-67-0x0000000001830000-0x0000000002230000-memory.dmpFilesize
10.0MB
-
memory/1968-66-0x0000000000400000-0x0000000000404400-memory.dmpFilesize
17KB
-
memory/1968-63-0x0000000000401000-mapping.dmp
-
memory/1968-61-0x0000000000400000-0x000000000149A000-memory.dmpFilesize
16.6MB