Overview

overview

10

Static

static

ac9621b85e...f0.exe

windows7_x64

10

ac9621b85e...f0.exe

windows10-2004_x64

8

Analysis

  • max time kernel
    151s
  • max time network
    156s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220414-en
  • submitted
    20-05-2022 21:48

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    ac9621b85e5f6b6c1335ea0f71ad93b1cd78bb94f62c36d9c86fc4832fc7aaf0.exe

  • Size

    25KB

  • MD5

    b6974c625e2a8c07e6202090a0062497

  • SHA1

    778ce55ed26bd5f9d20d0c29b5d2dc196466de49

  • SHA256

    ac9621b85e5f6b6c1335ea0f71ad93b1cd78bb94f62c36d9c86fc4832fc7aaf0

  • SHA512

    56d8549176aa1d3efd8f3c0a3927b2c76e5075eb036988b2bb58cc43357eca442439b5fa3bcd07de23c348e2d55412b11bcee2ebf7a67fd0ab698e5d75ebb95b

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 2 IoCs
  • Drops startup file 2 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops file in System32 directory 2 IoCs
  • Checks processor information in registry 2 TTPs 3 IoCs

    Processor information is often read in order to detect sandboxing environments.

  • Creates scheduled task(s) 1 TTPs 1 IoCs

    Schtasks is often used by malware for persistence or to perform post-infection execution.

    persistence
  • Enumerates system info in registry 2 TTPs 2 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 33 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\ac9621b85e5f6b6c1335ea0f71ad93b1cd78bb94f62c36d9c86fc4832fc7aaf0.exe
    "C:\Users\Admin\AppData\Local\Temp\ac9621b85e5f6b6c1335ea0f71ad93b1cd78bb94f62c36d9c86fc4832fc7aaf0.exe"
    1⤵
    • Drops startup file
    • Adds Run key to start application
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:432
    • C:\Windows\SYSTEM32\schtasks.exe
      schtasks /create /sc minute /mo 1 /tn Server /tr C:\Users\Admin\AppData\Local\Temp/Server.exe
      2⤵
      • Creates scheduled task(s)
      PID:4612
  • C:\Windows\System32\svchost.exe
    C:\Windows\System32\svchost.exe -k netsvcs -p
    1⤵
    • Drops file in System32 directory
    • Checks processor information in registry
    • Enumerates system info in registry
    PID:3272
  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    C:\Users\Admin\AppData\Local\Temp/Server.exe
    1⤵
    • Executes dropped EXE
    PID:4292
  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    C:\Users\Admin\AppData\Local\Temp/Server.exe
    1⤵
    • Executes dropped EXE
    PID:3188

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Scheduled Task

1
T1053

Persistence

Registry Run Keys / Startup Folder

1
T1060

Scheduled Task

1
T1053

Privilege Escalation

Scheduled Task

1
T1053

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Query Registry

2
T1012

System Information Discovery

2
T1082

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\Server.exe.log
    Filesize

    1KB

    MD5

    a8a147915e3a996fdbe10b3a3f1e1bb2

    SHA1

    abc564c1be468d57e700913e7b6cf8f62d421263

    SHA256

    8b96a8557deea66696837af011843d6a82451ba57c8f9b5a2726a70818d6fc7e

    SHA512

    17b42f17ef60a9f625703172763f692e5ed2ca93564a97853dfa72bb0ac6305ef3267aea0b205938e3aa8eac10156d9d4f322b30d0329d92d647bcec6372731c

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    Filesize

    25KB

    MD5

    b6974c625e2a8c07e6202090a0062497

    SHA1

    778ce55ed26bd5f9d20d0c29b5d2dc196466de49

    SHA256

    ac9621b85e5f6b6c1335ea0f71ad93b1cd78bb94f62c36d9c86fc4832fc7aaf0

    SHA512

    56d8549176aa1d3efd8f3c0a3927b2c76e5075eb036988b2bb58cc43357eca442439b5fa3bcd07de23c348e2d55412b11bcee2ebf7a67fd0ab698e5d75ebb95b

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    Filesize

    25KB

    MD5

    b6974c625e2a8c07e6202090a0062497

    SHA1

    778ce55ed26bd5f9d20d0c29b5d2dc196466de49

    SHA256

    ac9621b85e5f6b6c1335ea0f71ad93b1cd78bb94f62c36d9c86fc4832fc7aaf0

    SHA512

    56d8549176aa1d3efd8f3c0a3927b2c76e5075eb036988b2bb58cc43357eca442439b5fa3bcd07de23c348e2d55412b11bcee2ebf7a67fd0ab698e5d75ebb95b

    Download Submit
  • C:\Users\Admin\AppData\Local\Temp\Server.exe
    Filesize

    25KB

    MD5

    b6974c625e2a8c07e6202090a0062497

    SHA1

    778ce55ed26bd5f9d20d0c29b5d2dc196466de49

    SHA256

    ac9621b85e5f6b6c1335ea0f71ad93b1cd78bb94f62c36d9c86fc4832fc7aaf0

    SHA512

    56d8549176aa1d3efd8f3c0a3927b2c76e5075eb036988b2bb58cc43357eca442439b5fa3bcd07de23c348e2d55412b11bcee2ebf7a67fd0ab698e5d75ebb95b

    Download Submit
  • memory/432-130-0x0000000000050000-0x0000000000058000-memory.dmp
    Filesize

    32KB

    Download
  • memory/432-131-0x00007FFEA4C50000-0x00007FFEA5711000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/3188-138-0x00007FFEA4C50000-0x00007FFEA5711000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/4292-135-0x00007FFEA4C50000-0x00007FFEA5711000-memory.dmp
    Filesize

    10.8MB

    Download
  • memory/4612-132-0x0000000000000000-mapping.dmp
    Download