Overview

overview

10

Static

static

10

1.bin/1.exe

windows10_x64

10

2019-09-02...10.exe

windows10_x64

10

31.exe

windows10_x64

10

3DMark 11 ...on.exe

windows10_x64

1

5da0116af4...18.exe

windows10_x64

10

Archive.zi...3e.exe

windows10_x64

6

CVE-2018-1...oC.swf

windows10_x64

3

CVWSHSetup...1].exe

windows10_x64

4

DiskIntern...en.exe

windows10_x64

1

ForceOp 2....ce.exe

windows10_x64

10

HYDRA.exe

windows10_x64

10

Keygen.exe

windows10_x64

10

Lonelyscre...ox.exe

windows10_x64

1

LtHv0O2KZDK4M637.exe

windows10_x64

10

Magic_File...ja.exe

windows10_x64

1

OnlineInstaller.exe

windows10_x64

10

Remouse.Mi...cg.exe

windows10_x64

1

SecurityTa...up.exe

windows10_x64

8

Treasure.V...ox.exe

windows10_x64

1

VyprVPN.exe

windows10_x64

10

WSHSetup[1].exe

windows10_x64

3

___ _ ____....exe

windows10_x64

10

___ _ ____....exe

windows10_x64

10

amtemu.v0....ed.exe

windows10_x64

10

api.exe

windows10_x64

1

default.exe

windows10_x64

10

efd97b1038...ea4.js

windows10_x64

3

good.exe

windows10_x64

10

infected d...er.exe

windows10_x64

8

oof.exe

windows10_x64

10

ou55sg33s_1.exe

windows10_x64

10

update.exe

windows10_x64

10

Resubmissions

12-11-2021 18:04

211112-wnzb8aahhm 10

19-11-2020 10:08

201119-rhwlt38jrx 10

18-11-2020 17:26

201118-htd4fq29va 10

Analysis

  • max time kernel
    122s
  • max time network
    302s
  • platform
    windows10_x64
  • resource
    win10-en-20211014
  • submitted
    12-11-2021 18:04

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    Archive.zip__ccacaxs2tbz2t6ob3e.exe

  • Size

    430KB

  • MD5

    a3cab1a43ff58b41f61f8ea32319386b

  • SHA1

    94689e1a9e1503f1082b23e6d5984d4587f3b9ec

  • SHA256

    005d3b2b78fa134092a43e53112e5c8518f14cf66e57e6a3cc723219120baba6

  • SHA512

    8f084a866c608833c3bf95b528927d9c05e8d4afcd8a52c3434d45c8ba8220c25d2f09e00aade708bbbc83b4edea60baf826750c529e8e9e05b1242c56d0198d

Score
6/10

Malware Config

Signatures

  • Legitimate hosting services abused for malware hosting/C2 1 TTPs
  • Looks up external IP address via web service 1 IoCs

    Uses a legitimate IP lookup service to find the infected system's external IP.

  • Modifies system certificate store 2 TTPs 2 IoCs
    evasionspywaretrojan

Processes

  • C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe
    "C:\Users\Admin\AppData\Local\Temp\Archive.zip__ccacaxs2tbz2t6ob3e.exe"
    1⤵
    • Modifies system certificate store
    PID:3968

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Install Root Certificate

1
T1130

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Web Service

1
T1102

Impact

Replay Monitor

Loading Replay Monitor...

Downloads