Analysis
-
max time kernel
149s -
max time network
148s -
platform
windows7_x64 -
resource
win7v20210410 -
submitted
13-05-2021 02:08
Static task
static1
Behavioral task
behavioral1
Sample
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe
Resource
win7v20210410
Behavioral task
behavioral2
Sample
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe
Resource
win10v20210410
General
-
Target
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe
-
Size
152KB
-
MD5
bdf959504b5f4c4200e834929244b77b
-
SHA1
5e802ffa9f31ed6eb20d0ead8795394b3003ff8c
-
SHA256
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8
-
SHA512
028ea7463870901f73cb012dfc8210e567395dc3845f1952dbe41fc975157e3d24e8cbbc621b04c00361245181f10fe409a12b8c9979808b34a3026cbccff552
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
winver.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run winver.exe Set value (str) \REGISTRY\USER\S-1-5-21-2513283230-931923277-594887482-1000\Software\Microsoft\Windows\CurrentVersion\Run\A6B4A7C1 = "C:\\Users\\Admin\\AppData\\Roaming\\A6B4A7C1\\bin.exe" winver.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exedescription pid process target process PID 336 set thread context of 1308 336 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe -
Suspicious behavior: EnumeratesProcesses 64 IoCs
Processes:
winver.exepid process 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe 828 winver.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE -
Suspicious use of FindShellTrayWindow 5 IoCs
Processes:
winver.exeExplorer.EXEpid process 828 winver.exe 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SendNotifyMessage 4 IoCs
Processes:
Explorer.EXEpid process 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE 1264 Explorer.EXE -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exepid process 336 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exede81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exewinver.exedescription pid process target process PID 336 wrote to memory of 1308 336 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 336 wrote to memory of 1308 336 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 336 wrote to memory of 1308 336 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 336 wrote to memory of 1308 336 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 336 wrote to memory of 1308 336 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 336 wrote to memory of 1308 336 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 336 wrote to memory of 1308 336 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 336 wrote to memory of 1308 336 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe PID 1308 wrote to memory of 828 1308 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe winver.exe PID 1308 wrote to memory of 828 1308 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe winver.exe PID 1308 wrote to memory of 828 1308 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe winver.exe PID 1308 wrote to memory of 828 1308 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe winver.exe PID 1308 wrote to memory of 828 1308 de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe winver.exe PID 828 wrote to memory of 1264 828 winver.exe Explorer.EXE PID 828 wrote to memory of 1128 828 winver.exe taskhost.exe PID 828 wrote to memory of 1212 828 winver.exe Dwm.exe PID 828 wrote to memory of 1264 828 winver.exe Explorer.EXE
Processes
-
C:\Windows\Explorer.EXEC:\Windows\Explorer.EXE1⤵
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of FindShellTrayWindow
- Suspicious use of SendNotifyMessage
PID:1264 -
C:\Users\Admin\AppData\Local\Temp\de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe"C:\Users\Admin\AppData\Local\Temp\de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe"2⤵
- Suspicious use of SetThreadContext
- Suspicious use of SetWindowsHookEx
- Suspicious use of WriteProcessMemory
PID:336 -
C:\Users\Admin\AppData\Local\Temp\de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe"C:\Users\Admin\AppData\Local\Temp\de81c2c568fd7912bcf194be4958fa0b2960a9f09f4efac247a5bacc0c5468c8.exe"3⤵
- Suspicious use of WriteProcessMemory
PID:1308 -
C:\Windows\SysWOW64\winver.exewinver4⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of FindShellTrayWindow
- Suspicious use of WriteProcessMemory
PID:828
-
C:\Windows\system32\Dwm.exe"C:\Windows\system32\Dwm.exe"1⤵PID:1212
-
C:\Windows\system32\taskhost.exe"taskhost.exe"1⤵PID:1128
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/336-62-0x0000000075551000-0x0000000075553000-memory.dmpFilesize
8KB
-
memory/828-69-0x00000000009C0000-0x00000000009D6000-memory.dmpFilesize
88KB
-
memory/828-70-0x0000000000140000-0x0000000000147000-memory.dmpFilesize
28KB
-
memory/828-65-0x0000000000000000-mapping.dmp
-
memory/828-71-0x0000000000180000-0x0000000000181000-memory.dmpFilesize
4KB
-
memory/1128-73-0x0000000001D60000-0x0000000001D67000-memory.dmpFilesize
28KB
-
memory/1212-74-0x00000000001A0000-0x00000000001A7000-memory.dmpFilesize
28KB
-
memory/1264-72-0x0000000002F00000-0x0000000002F07000-memory.dmpFilesize
28KB
-
memory/1264-75-0x0000000002F10000-0x0000000002F17000-memory.dmpFilesize
28KB
-
memory/1264-77-0x0000000077440000-0x0000000077441000-memory.dmpFilesize
4KB
-
memory/1264-76-0x0000000077450000-0x0000000077451000-memory.dmpFilesize
4KB
-
memory/1264-78-0x0000000077420000-0x0000000077421000-memory.dmpFilesize
4KB
-
memory/1308-63-0x0000000000400000-0x0000000000405000-memory.dmpFilesize
20KB
-
memory/1308-68-0x00000000004B0000-0x0000000000EB0000-memory.dmpFilesize
10.0MB
-
memory/1308-64-0x0000000000401000-mapping.dmp