Analysis

  • max time kernel
    28s
  • max time network
    135s
  • platform
    windows10_x64
  • resource
    win10v20210410
  • submitted
    27-06-2021 11:20

General

  • Target

    TT-4.exe

  • Size

    307KB

  • MD5

    19295d360b9ca2678d757d87d9445a65

  • SHA1

    ac9d2e9364f8914004af53406627e04fc8ce2b9d

  • SHA256

    f6baf2cbb7e86d3c1e140b0cc62dec7de55cc5359eeee7eda6f21ce0a00c13e9

  • SHA512

    25af690a903a1cac3716bfe347dd5ef3f68b2cf5da227603b37d003e47a0b6394a77d69b48a9b430cbbbf9f309a4c8eff3eee58d13326b99c755d399c892c156

Score
8/10

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Suspicious behavior: AddClipboardFormatListener 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 15 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 8 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\TT-4.exe
    "C:\Users\Admin\AppData\Local\Temp\TT-4.exe"
    1⤵
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:2228
    • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
      2⤵
      • Executes dropped EXE
      • Suspicious behavior: AddClipboardFormatListener
      PID:3456

Network

MITRE ATT&CK Matrix ATT&CK v6

Persistence

Registry Run Keys / Startup Folder

1
T1060

Defense Evasion

Modify Registry

1
T1112

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • C:\Users\Admin\AppData\Local\Temp\RegAsm.exe
    MD5

    b58b926c3574d28d5b7fdd2ca3ec30d5

    SHA1

    d260c4ffd603a9cfc057fcb83d678b1cecdf86f9

    SHA256

    6e70b56d748c4ccab13cc8a055d3795ea0dd95fe3b70568d7d3ac0c6621140a3

    SHA512

    b13cb998822b716b695013bcd6dec62a2290567d0d1743b2d982ca084235cf69c6ea1fc91c9d4e62657c6f9e102c7c60e81296ab055ffe43b887c5f8ec8958ab

  • memory/2228-125-0x0000000005690000-0x0000000005691000-memory.dmp
    Filesize

    4KB

  • memory/2228-122-0x0000000003030000-0x0000000003047000-memory.dmp
    Filesize

    92KB

  • memory/2228-123-0x0000000005560000-0x0000000005561000-memory.dmp
    Filesize

    4KB

  • memory/2228-124-0x0000000005B20000-0x0000000005B21000-memory.dmp
    Filesize

    4KB

  • memory/2228-114-0x0000000000C20000-0x0000000000C21000-memory.dmp
    Filesize

    4KB

  • memory/2228-117-0x0000000005610000-0x0000000005611000-memory.dmp
    Filesize

    4KB

  • memory/2228-116-0x0000000001350000-0x0000000001352000-memory.dmp
    Filesize

    8KB

  • memory/3456-127-0x000000000040453A-mapping.dmp
  • memory/3456-126-0x0000000000400000-0x0000000000436000-memory.dmp
    Filesize

    216KB

  • memory/3456-134-0x0000000005880000-0x0000000005881000-memory.dmp
    Filesize

    4KB

  • memory/3456-135-0x0000000006400000-0x0000000006401000-memory.dmp
    Filesize

    4KB