Analysis
-
max time kernel
9s -
max time network
35s -
platform
windows7_x64 -
resource
win7v20210408 -
submitted
28-05-2021 09:57
General
-
Target
79323434542bf442218be77d3982e167e118dc9954ce9ea1726db42bcac4d249.bin.sample.exe
-
Size
165KB
-
MD5
1407b521eded12eca22dc4a12421be59
-
SHA1
031cf6f7f62cbea5753b3d6cc7ee113f69aa43a3
-
SHA256
79323434542bf442218be77d3982e167e118dc9954ce9ea1726db42bcac4d249
-
SHA512
79ed739a0ad7f9b45150f491dc9e1cd9f8d4b828fc0ff82bdc23307c4e31efefb862d163ded840438759805b3a792b3fa569d3cce13e4702987a107bc85d3406
Score
10/10
Malware Config
Signatures
-
Modifies WinLogon for persistence 2 TTPs 1 IoCs
-
Modifies boot configuration data using bcdedit 1 TTPs 1 IoCs
-
Windows security modification 2 TTPs 1 IoCs
-
Modifies registry key 1 TTPs 1 IoCs
-
Runs net.exe
-
Suspicious behavior: EnumeratesProcesses 64 IoCs
-
Suspicious use of AdjustPrivilegeToken 7 IoCs
-
Suspicious use of WriteProcessMemory 18 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\79323434542bf442218be77d3982e167e118dc9954ce9ea1726db42bcac4d249.bin.sample.exe"C:\Users\Admin\AppData\Local\Temp\79323434542bf442218be77d3982e167e118dc9954ce9ea1726db42bcac4d249.bin.sample.exe"1⤵
- Windows security modification
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\reg.exe"reg.exe" delete HKLM\System\CurrentControlSet\Control\SafeBoot\Minimal\WinDefend /f2⤵
- Modifies registry key
-
C:\Windows\system32\bcdedit.exe"bcdedit.exe" /set {default} safeboot network2⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\reg.exe"reg.exe" add "HKLM\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon" /v Userinit /t REG_SZ /d "C:\Users\Admin\AppData\Local\Temp\79323434542bf442218be77d3982e167e118dc9954ce9ea1726db42bcac4d249.bin.sample.exe","C:\Windows\system32\userinit.exe" /f2⤵
- Modifies WinLogon for persistence
-
C:\Windows\system32\net.exe"net.exe" user Admin ""2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\net1.exeC:\Windows\system32\net1 user Admin ""3⤵
-
C:\Windows\system32\shutdown.exe"shutdown.exe" /r /t 02⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\LogonUI.exe"LogonUI.exe" /flags:0x01⤵
-
C:\Windows\system32\AUDIODG.EXEC:\Windows\system32\AUDIODG.EXE 0x1801⤵
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/760-67-0x000007FEFC251000-0x000007FEFC253000-memory.dmpFilesize
8KB
-
memory/760-69-0x00000000027C0000-0x00000000027C1000-memory.dmpFilesize
4KB
-
memory/1344-62-0x0000000000000000-mapping.dmp
-
memory/1352-61-0x0000000000000000-mapping.dmp
-
memory/1544-64-0x0000000000000000-mapping.dmp
-
memory/1624-63-0x0000000000000000-mapping.dmp
-
memory/1836-66-0x0000000000000000-mapping.dmp
-
memory/1912-65-0x0000000000000000-mapping.dmp
-
memory/2000-59-0x0000000000D40000-0x0000000000D41000-memory.dmpFilesize
4KB
-
memory/2000-68-0x000000001AEA0000-0x000000001AEA2000-memory.dmpFilesize
8KB