Analysis
- max time kernel
4265105s - max time network
162s - platform
windows10-2004_x64 - resource
win10v2004-en-20220112 - submitted
17/01/2022, 06:42
General
- Target 98aad1f7117ea43141357bff416027f0.exe
- Size 210KB
- Sample220117-hgcb8ahbap
- SHA256 ff61854c347ac02b4832092f146458fd480edee1a7b09114b754ffbb7a959db8
Malware Config
Signatures
- Downloads MZ/PE file
- Suspicious use of SetThreadContext 1 IoCs
- Checks processor information in registry 2 TTPs 2 IoCs
Processor information is often read in order to detect sandboxing environments.
- Suspicious use of AdjustPrivilegeToken 3 IoCs
- Suspicious use of WriteProcessMemory 8 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\98aad1f7117ea43141357bff416027f0.exe"C:\Users\Admin\AppData\Local\Temp\98aad1f7117ea43141357bff416027f0.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegAsm.exe"2⤵
-
-
C:\Windows\system32\MusNotification.exeC:\Windows\system32\MusNotification.exe1⤵
- Checks processor information in registry
- Suspicious use of AdjustPrivilegeToken
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
memory/2124-142-0x0000000004EF0000-0x0000000004F02000-memory.dmp
memory/2124-140-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2124-145-0x0000000004EA0000-0x00000000054B8000-memory.dmp
memory/2124-144-0x0000000004F90000-0x0000000004FCC000-memory.dmp
memory/2124-143-0x0000000005020000-0x000000000512A000-memory.dmp
memory/2124-141-0x00000000054C0000-0x0000000005AD8000-memory.dmp
memory/2124-139-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2124-138-0x0000000000400000-0x0000000000420000-memory.dmp
memory/2808-131-0x00000000000F0000-0x0000000000122000-memory.dmp
memory/2808-136-0x0000000004B10000-0x00000000050B4000-memory.dmp
memory/2808-135-0x0000000004AB0000-0x0000000004ABA000-memory.dmp
memory/2808-130-0x00000000000F0000-0x0000000000122000-memory.dmp
memory/2808-134-0x0000000004B10000-0x00000000050B4000-memory.dmp
memory/2808-133-0x0000000004B10000-0x0000000004BA2000-memory.dmp
memory/2808-132-0x00000000050C0000-0x0000000005664000-memory.dmp