Analysis
-
max time kernel
147s -
max time network
144s -
platform
windows10_x64 -
resource
win10v20210408 -
submitted
14-09-2021 23:26
Static task
static1
Behavioral task
behavioral1
Sample
adobe1.exe
Resource
win7-en
Behavioral task
behavioral2
Sample
adobe1.exe
Resource
win10v20210408
General
-
Target
adobe1.exe
-
Size
575KB
-
MD5
fa0469c74632450ff280cda736e3b589
-
SHA1
2a125739fc91b38f69c021d8c1e9f66f15da7c1b
-
SHA256
9c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9
-
SHA512
291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9
Malware Config
Signatures
-
Processes:
resource yara_rule behavioral2/memory/580-115-0x0000000013140000-0x000000001338D000-memory.dmp upx behavioral2/memory/580-117-0x0000000013140000-0x000000001338D000-memory.dmp upx behavioral2/memory/1840-119-0x0000000013140000-0x000000001338D000-memory.dmp upx -
Adds Run key to start application 2 TTPs 4 IoCs
Processes:
LaunchWinApp.exeLaunchWinApp.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run LaunchWinApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\{B6A807N6-42DF-4W02-93E5-B156B3FA8AL1} = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" LaunchWinApp.exe Key created \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run LaunchWinApp.exe Set value (str) \REGISTRY\USER\S-1-5-21-1594587808-2047097707-2163810515-1000\Software\Microsoft\Windows\CurrentVersion\Run\{B6A807N6-42DF-4W02-93E5-B156B3FA8AL1} = "C:\\Users\\Admin\\AppData\\Roaming\\Adobe\\svchost.exe" LaunchWinApp.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
adobe1.exedescription pid process target process PID 1096 set thread context of 580 1096 adobe1.exe adobe1.exe -
Suspicious use of WriteProcessMemory 17 IoCs
Processes:
adobe1.exeadobe1.exedescription pid process target process PID 1096 wrote to memory of 580 1096 adobe1.exe adobe1.exe PID 1096 wrote to memory of 580 1096 adobe1.exe adobe1.exe PID 1096 wrote to memory of 580 1096 adobe1.exe adobe1.exe PID 1096 wrote to memory of 580 1096 adobe1.exe adobe1.exe PID 1096 wrote to memory of 580 1096 adobe1.exe adobe1.exe PID 580 wrote to memory of 1840 580 adobe1.exe LaunchWinApp.exe PID 580 wrote to memory of 1840 580 adobe1.exe LaunchWinApp.exe PID 580 wrote to memory of 1840 580 adobe1.exe LaunchWinApp.exe PID 580 wrote to memory of 1840 580 adobe1.exe LaunchWinApp.exe PID 580 wrote to memory of 2120 580 adobe1.exe LaunchWinApp.exe PID 580 wrote to memory of 2120 580 adobe1.exe LaunchWinApp.exe PID 580 wrote to memory of 2120 580 adobe1.exe LaunchWinApp.exe PID 580 wrote to memory of 2120 580 adobe1.exe LaunchWinApp.exe PID 580 wrote to memory of 1472 580 adobe1.exe LaunchWinApp.exe PID 580 wrote to memory of 1472 580 adobe1.exe LaunchWinApp.exe PID 580 wrote to memory of 1472 580 adobe1.exe LaunchWinApp.exe PID 580 wrote to memory of 1472 580 adobe1.exe LaunchWinApp.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\adobe1.exe"C:\Users\Admin\AppData\Local\Temp\adobe1.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
-
C:\Users\Admin\AppData\Local\Temp\adobe1.exe"C:\Users\Admin\AppData\Local\Temp\adobe1.exe"2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\LaunchWinApp.exeC:\Windows\system32\LaunchWinApp.exe3⤵
-
C:\Windows\SysWOW64\LaunchWinApp.exeC:\Windows\system32\LaunchWinApp.exe3⤵
- Adds Run key to start application
-
C:\Windows\SysWOW64\LaunchWinApp.exeC:\Windows\system32\LaunchWinApp.exe3⤵
- Adds Run key to start application
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Roaming\Adobe\svchost.exeMD5
fa0469c74632450ff280cda736e3b589
SHA12a125739fc91b38f69c021d8c1e9f66f15da7c1b
SHA2569c85331956b4018e4bccaa097b452c1cc368183d8f2a34e55e251a616a1f2cb9
SHA512291256e19f7ef82e57c4223ae8777aeaf39767dba3adf3c6b39c57b2f6c6d4d292d7ace2d53a8536d9d5973088a5156c41e663f38dc9a2b7b384bbf45184b3e9
-
memory/580-115-0x0000000013140000-0x000000001338D000-memory.dmpFilesize
2.3MB
-
memory/580-116-0x000000001338B560-mapping.dmp
-
memory/580-117-0x0000000013140000-0x000000001338D000-memory.dmpFilesize
2.3MB
-
memory/1096-114-0x0000000000580000-0x00000000006CA000-memory.dmpFilesize
1.3MB
-
memory/1472-121-0x0000000000000000-mapping.dmp
-
memory/1840-118-0x0000000000000000-mapping.dmp
-
memory/1840-119-0x0000000013140000-0x000000001338D000-memory.dmpFilesize
2.3MB
-
memory/2120-120-0x0000000000000000-mapping.dmp