Overview

overview

10

Static

static

8

test/91B5D...9D.msi

windows7_x64

8

test/91B5D...9D.msi

windows10-2004_x64

1

test/ed01e...aa.exe

windows7_x64

10

test/ed01e...aa.exe

windows10-2004_x64

10

test/fe9d7...8f.exe

windows7_x64

10

test/fe9d7...8f.exe

windows10-2004_x64

10

test/main.exe

windows7_x64

1

test/main.exe

windows10-2004_x64

10

test/main_temp.exe

windows7_x64

1

test/main_temp.exe

windows10-2004_x64

1

Analysis

  • max time kernel
    165s
  • max time network
    174s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-ja-20220112
  • submitted
    19-01-2022 15:40

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    test/main.exe

  • Size

    2.2MB

  • MD5

    5ffb3bfb8e0b0002d940ad4707d1c504

  • SHA1

    ed6402ebc9050fd7c85384ec88343c556df3a71e

  • SHA256

    aa80d3eaee384c8a0ba25b3d501dc0c83f7405190ae47877595fc63cf3161dcf

  • SHA512

    3f05b5c0c80223ecff25f7c8c6a1d6b6462e80ca918f526b6fe0e229f0c1631ea25bf0f856338551e32f8cf9a2a0c838941136cd788ae89b1826aaeeb2a2ccf0

Score
10/10
persistence

Malware Config

Signatures

  • Registers COM server for autorun 1 TTPs
    persistence
  • Executes dropped EXE 3 IoCs
  • Loads dropped DLL 24 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Drops file in System32 directory 1 IoCs
  • Drops file in Program Files directory 64 IoCs
  • Drops file in Windows directory 64 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Enumerates system info in registry 2 TTPs 3 IoCs
  • Modifies Internet Explorer settings 1 TTPs 4 IoCs
    adwarespyware
  • Modifies data under HKEY_USERS 3 IoCs
  • Modifies registry class 64 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious use of AdjustPrivilegeToken 64 IoCs
  • Suspicious use of FindShellTrayWindow 4 IoCs
  • Suspicious use of SendNotifyMessage 3 IoCs
  • Suspicious use of SetWindowsHookEx 4 IoCs
  • Suspicious use of WriteProcessMemory 18 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\test\main.exe
    "C:\Users\Admin\AppData\Local\Temp\test\main.exe"
    1⤵
      PID:3876
    • C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe
      "C:\Program Files\Microsoft Office\Root\Office16\SDXHelper.exe" -Embedding
      1⤵
      • Checks processor information in registry
      • Enumerates system info in registry
      • Suspicious use of SetWindowsHookEx
      PID:3204
    • C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.245.1128.0002\FileSyncConfig.exe
      "C:\Users\Admin\AppData\Local\Microsoft\OneDrive\21.245.1128.0002\FileSyncConfig.exe"
      1⤵
      • Modifies registry class
      PID:2628
    • C:\ProgramData\Adobe\ARM\S\18764\AdobeARMHelper.exe
      "C:\ProgramData\Adobe\ARM\S\18764\AdobeARMHelper.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\18764" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU
      1⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:4036
      • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
        "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" /ArmUpdate /MSI FOLDER:"C:\ProgramData\Adobe\ARM\S\18764" /MODE:3 /PRODUCT:Reader /VERSION:19.0 /LANG:ENU
        2⤵
        • Executes dropped EXE
        • Suspicious use of FindShellTrayWindow
        • Suspicious use of SendNotifyMessage
        • Suspicious use of SetWindowsHookEx
        PID:3256
    • C:\Windows\system32\msiexec.exe
      C:\Windows\system32\msiexec.exe /V
      1⤵
      • Enumerates connected drives
      • Drops file in Program Files directory
      • Drops file in Windows directory
      • Modifies Internet Explorer settings
      • Modifies data under HKEY_USERS
      • Modifies registry class
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3336
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 80DA645BC9A75B6D7CB0D505B8C94BE0
        2⤵
        • Loads dropped DLL
        PID:1536
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 868053A3ADE2ED343303C5CBE7A4A2A6 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        PID:2428
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 11538AED35466BF5A152ED269158E7ED
        2⤵
        • Loads dropped DLL
        • Drops file in System32 directory
        PID:2500
      • C:\Windows\syswow64\MsiExec.exe
        C:\Windows\syswow64\MsiExec.exe -Embedding 543335D6DBF1D367D73C146399B1A1A7 E Global\MSI0000
        2⤵
        • Loads dropped DLL
        • Suspicious behavior: EnumeratesProcesses
        PID:3644
      • C:\Windows\Installer\MSIF661.tmp
        "C:\Windows\Installer\MSIF661.tmp" /b 2 120 0
        2⤵
        • Executes dropped EXE
        PID:3356
    • C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
      "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe"
      1⤵
      • Executes dropped EXE
      PID:444

    Network

    MITRE ATT&CK Enterprise v6

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • memory/3204-131-0x00007FFDDC290000-0x00007FFDDC2A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3204-132-0x00007FFDDC290000-0x00007FFDDC2A0000-memory.dmp

      Filesize

      64KB

      Download

    • memory/3204-133-0x00007FFDDC290000-0x00007FFDDC2A0000-memory.dmp

      Filesize

      64KB

      Download