Analysis
-
max time kernel
150s -
max time network
153s -
platform
windows10-2004_x64 -
resource
win10v2004-20220414-en -
submitted
22-06-2022 08:10
Static task
static1
Behavioral task
behavioral1
Sample
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe
Resource
win7-20220414-en
Behavioral task
behavioral2
Sample
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe
Resource
win10v2004-20220414-en
General
-
Target
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe
-
Size
769KB
-
MD5
54f329e755ead912faa7b0223e256fe8
-
SHA1
9077aa1adb4c64577ac8abb444f46466e1c15234
-
SHA256
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257
-
SHA512
0513e3c3c0fdc91ccdb1a6055c5148c48477f09ab281d5f7b72cb4278889ee037ecebaf667da44156d99de280e028f3673edade9fbdf986d3843642d4c054fc2
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exedescription ioc Process Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "C:\\Users\\Admin\\AppData\\Roaming\\winzip\\Services.exe" 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe Set value (str) \REGISTRY\USER\S-1-5-21-2632097139-1792035885-811742494-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Run\Services = "\\winzip\\Services.exe" 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe -
Suspicious use of SetThreadContext 1 IoCs
Processes:
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exedescription pid Process procid_target PID 788 set thread context of 3888 788 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 80 -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exepid Process 3888 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe -
Suspicious use of AdjustPrivilegeToken 4 IoCs
Processes:
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exedescription pid Process Token: SeDebugPrivilege 788 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe Token: SeDebugPrivilege 3888 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe Token: 33 3888 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe Token: SeIncBasePriorityPrivilege 3888 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe -
Suspicious use of SetWindowsHookEx 1 IoCs
Processes:
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exepid Process 3888 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe -
Suspicious use of WriteProcessMemory 8 IoCs
Processes:
2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exedescription pid Process procid_target PID 788 wrote to memory of 3888 788 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 80 PID 788 wrote to memory of 3888 788 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 80 PID 788 wrote to memory of 3888 788 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 80 PID 788 wrote to memory of 3888 788 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 80 PID 788 wrote to memory of 3888 788 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 80 PID 788 wrote to memory of 3888 788 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 80 PID 788 wrote to memory of 3888 788 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 80 PID 788 wrote to memory of 3888 788 2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe 80
Processes
-
C:\Users\Admin\AppData\Local\Temp\2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe"C:\Users\Admin\AppData\Local\Temp\2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe"1⤵
- Suspicious use of SetThreadContext
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
PID:788 -
C:\Users\Admin\AppData\Local\Temp\2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe"C:\Users\Admin\AppData\Local\Temp\2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe"2⤵
- Adds Run key to start application
- Suspicious behavior: GetForegroundWindowSpam
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of SetWindowsHookEx
PID:3888
-
-
C:\Windows\system32\wbem\WmiApSrv.exeC:\Windows\system32\wbem\WmiApSrv.exe1⤵PID:1292
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0_32\UsageLogs\2e8d129e67feb877b782f5b86850221a92550542c909def363497f962c586257.exe.log
Filesize706B
MD5ee844796f619ac16a2c818f8d4efd88c
SHA1ce7e1cd02117d8f49c239daa46d340a93350894b
SHA25609847785ef0dc53c0394ed47010cd3cac5cca271ad84f58264f1e244ee81c341
SHA512b856874aafc68ebc9fbd8755876f53d7f4a2ea1c41322e5d1ef1e83b54b053606e3571bb434d711a6cf150b444dbf303441930e00340ea41e8e3f98fe3df77c7