Analysis
- max time kernel
150s - max time network
153s - platform
windows10-2004_x64 - resource
win10v2004-20220812-en - resource tags
arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system - submitted
20/08/2022, 07:51
Static task
static1
Behavioral task
behavioral1
Sample
eb59130bf288c166ef8f119bc5354c9a.exe
Resource
win7-20220812-en
windows7-x64
3 signatures
150 seconds
Behavioral task
behavioral2
Sample
eb59130bf288c166ef8f119bc5354c9a.exe
Resource
win10v2004-20220812-en
windows10-2004-x64
10 signatures
150 seconds
General
- Target eb59130bf288c166ef8f119bc5354c9a.exe
- Size 219KB
- Sample220820-jptf5sbdf3
- SHA256 857b7f40ec30133e2bfce32910de053032fc5dc7146c2eb3c53c1e9d0e30262a
- MD5 eb59130bf288c166ef8f119bc5354c9a
- SHA1 7545c150b20c473469eaf1cbba55060d260c7f9b
- SHA512 ab044ba24f9ab32b26e209a04c09683e015ff35423535f04e419a469abfa1145cb1a3cba4755af6ccd42959251f7434640451cb71d74d3059bab4e11c34f19a4
- MD5 SHA1 SHA512
Score
8/10
Malware Config
Signatures
- Downloads MZ/PE file
- Executes dropped EXE 3 IoCs
pid Process 4016 26D1.exe 4708 370F.exe 1452 4E9F.exe - Suspicious use of SetThreadContext 1 IoCs
description pid Process procid_target PID 4708 set thread context of 3116 4708 370F.exe 91 - Program crash 1 IoCs
pid pid_target Process procid_target 2592 4708 WerFault.exe 89 - Checks SCSI registry key(s) 3 TTPs 6 IoCs
SCSI information is often read in order to detect sandboxing environments.
description ioc Process Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb59130bf288c166ef8f119bc5354c9a.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb59130bf288c166ef8f119bc5354c9a.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI RegSvcs.exe Key queried \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI RegSvcs.exe Key enumerated \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI RegSvcs.exe Key opened \REGISTRY\MACHINE\SYSTEM\ControlSet001\Enum\SCSI eb59130bf288c166ef8f119bc5354c9a.exe - Suspicious behavior: EnumeratesProcesses 64 IoCs
pid Process 4248 eb59130bf288c166ef8f119bc5354c9a.exe 4248 eb59130bf288c166ef8f119bc5354c9a.exe 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found 2132 Process not Found - Suspicious behavior: GetForegroundWindowSpam 1 IoCs
pid Process 2132 Process not Found - Suspicious behavior: MapViewOfSection 2 IoCs
pid Process 4248 eb59130bf288c166ef8f119bc5354c9a.exe 3116 RegSvcs.exe - Suspicious use of AdjustPrivilegeToken 14 IoCs
description pid Process Token: SeShutdownPrivilege 2132 Process not Found Token: SeCreatePagefilePrivilege 2132 Process not Found Token: SeShutdownPrivilege 2132 Process not Found Token: SeCreatePagefilePrivilege 2132 Process not Found Token: SeShutdownPrivilege 2132 Process not Found Token: SeCreatePagefilePrivilege 2132 Process not Found Token: SeShutdownPrivilege 2132 Process not Found Token: SeCreatePagefilePrivilege 2132 Process not Found Token: SeShutdownPrivilege 2132 Process not Found Token: SeCreatePagefilePrivilege 2132 Process not Found Token: SeShutdownPrivilege 2132 Process not Found Token: SeCreatePagefilePrivilege 2132 Process not Found Token: SeShutdownPrivilege 2132 Process not Found Token: SeCreatePagefilePrivilege 2132 Process not Found - Suspicious use of WriteProcessMemory 14 IoCs
description pid Process procid_target PID 2132 wrote to memory of 4016 2132 Process not Found 85 PID 2132 wrote to memory of 4016 2132 Process not Found 85 PID 2132 wrote to memory of 4016 2132 Process not Found 85 PID 2132 wrote to memory of 4708 2132 Process not Found 89 PID 2132 wrote to memory of 4708 2132 Process not Found 89 PID 2132 wrote to memory of 4708 2132 Process not Found 89 PID 4708 wrote to memory of 3116 4708 370F.exe 91 PID 4708 wrote to memory of 3116 4708 370F.exe 91 PID 4708 wrote to memory of 3116 4708 370F.exe 91 PID 4708 wrote to memory of 3116 4708 370F.exe 91 PID 4708 wrote to memory of 3116 4708 370F.exe 91 PID 2132 wrote to memory of 1452 2132 Process not Found 97 PID 2132 wrote to memory of 1452 2132 Process not Found 97 PID 2132 wrote to memory of 1452 2132 Process not Found 97
Processes
-
C:\Users\Admin\AppData\Local\Temp\eb59130bf288c166ef8f119bc5354c9a.exe"C:\Users\Admin\AppData\Local\Temp\eb59130bf288c166ef8f119bc5354c9a.exe"1⤵
- Checks SCSI registry key(s)
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
PID:4248
-
C:\Users\Admin\AppData\Local\Temp\26D1.exeC:\Users\Admin\AppData\Local\Temp\26D1.exe1⤵
- Executes dropped EXE
PID:4016
-
C:\Users\Admin\AppData\Local\Temp\370F.exeC:\Users\Admin\AppData\Local\Temp\370F.exe1⤵
- Executes dropped EXE
- Suspicious use of SetThreadContext
- Suspicious use of WriteProcessMemory
PID:4708 -
C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"C:\Windows\Microsoft.NET\Framework\v4.0.30319\RegSvcs.exe"2⤵
- Checks SCSI registry key(s)
- Suspicious behavior: MapViewOfSection
PID:3116
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -u -p 4708 -s 2802⤵
- Program crash
PID:2592
-
-
C:\Windows\SysWOW64\WerFault.exeC:\Windows\SysWOW64\WerFault.exe -pss -s 444 -p 4708 -ip 47081⤵PID:1244
-
C:\Users\Admin\AppData\Local\Temp\4E9F.exeC:\Users\Admin\AppData\Local\Temp\4E9F.exe1⤵
- Executes dropped EXE
PID:1452
Network
MITRE ATT&CK Enterprise v6
Replay Monitor
Loading Replay Monitor...
Downloads
- Path C:\Users\Admin\AppData\Local\Temp\26D1.exe
- Size 757KB
- SHA256 f652f34d1f70a4b235a252302da5cf063882dd6ee0ee6904dd89eafb86607d0f
- MD5 1a6eea2b0ac7782636da83d13a97403d
- SHA1 73103c1668b473a6bc12a007ece900ddb79cc854
- SHA512 6aeb16b05a1bd04e018ba48303889afd0073870b36f85ddcc53758029a8ddd6e157080d5b18e2f562a7b6ec6328447fa9d4127a5c648d50a5450ec9d1cd85077
- SSDEEP 12288:7RUQ/DK21WSRL3oXY+/zNi7Dha0pePTvJRXYBVMAqn4jNZYXm0ipZrNPA76:77zXL3oXVw700pe7zXYBVgn4jNZYXdim
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\26D1.exe
- Size 757KB
- SHA256 f652f34d1f70a4b235a252302da5cf063882dd6ee0ee6904dd89eafb86607d0f
- MD5 1a6eea2b0ac7782636da83d13a97403d
- SHA1 73103c1668b473a6bc12a007ece900ddb79cc854
- SHA512 6aeb16b05a1bd04e018ba48303889afd0073870b36f85ddcc53758029a8ddd6e157080d5b18e2f562a7b6ec6328447fa9d4127a5c648d50a5450ec9d1cd85077
- SSDEEP 12288:7RUQ/DK21WSRL3oXY+/zNi7Dha0pePTvJRXYBVMAqn4jNZYXm0ipZrNPA76:77zXL3oXVw700pe7zXYBVgn4jNZYXdim
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\370F.exe
- Size 124KB
- SHA256 ca2847a10f769300fedc4c5127562e0c65f4def8b353763318b44c48381b782e
- MD5 61de588d23e9467ef8f4e05001f38de1
- SHA1 c4e435e718420252a79c0a3494f905db855632c6
- SHA512 888d8cca3fb994ccc089a56f25856a32a37cdf853ec7b4f4dfe600fd2a64035dfcc72843fd0538ba2c0e11539aff7a24d58f4ded84537c46da7477a3c28a7161
- SSDEEP 3072:l/5VSLQXz7JraM1PSRU4viRGEqLe+z/JgAMYAY0hrAKugZ/sJj:Z5poM1uJY/cKuWUJj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\370F.exe
- Size 124KB
- SHA256 ca2847a10f769300fedc4c5127562e0c65f4def8b353763318b44c48381b782e
- MD5 61de588d23e9467ef8f4e05001f38de1
- SHA1 c4e435e718420252a79c0a3494f905db855632c6
- SHA512 888d8cca3fb994ccc089a56f25856a32a37cdf853ec7b4f4dfe600fd2a64035dfcc72843fd0538ba2c0e11539aff7a24d58f4ded84537c46da7477a3c28a7161
- SSDEEP 3072:l/5VSLQXz7JraM1PSRU4viRGEqLe+z/JgAMYAY0hrAKugZ/sJj:Z5poM1uJY/cKuWUJj
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\4E9F.exe
- Size 757KB
- SHA256 dc10453069e155da5dd37dff04c8b3bc82d8e92bde445c45c449b4ecb8e08486
- MD5 286f9078260e18becf99588e9b068b8a
- SHA1 e0e8f88287fac2f93f46af0c4563204f5e8cd26c
- SHA512 0b0386117fc54cbe14ff935c17691162e30e955e6b39999457d6e12b7f366ea6419d264b71cd75f83b36d2ec1f3b9dcc1c42b062f67da239a47d4904d313c55a
- SSDEEP 12288:7RUQ/DK21WSRL3oXY+/zNi7Dha0pePTvJRXYBVMAqn4jNZYXm0ipZWZPA76:77zXL3oXVw700pe7zXYBVgn4jNZYXdi7
- MD5 SHA1 SHA512 SSDEEP
- Path C:\Users\Admin\AppData\Local\Temp\4E9F.exe
- Size 757KB
- SHA256 dc10453069e155da5dd37dff04c8b3bc82d8e92bde445c45c449b4ecb8e08486
- MD5 286f9078260e18becf99588e9b068b8a
- SHA1 e0e8f88287fac2f93f46af0c4563204f5e8cd26c
- SHA512 0b0386117fc54cbe14ff935c17691162e30e955e6b39999457d6e12b7f366ea6419d264b71cd75f83b36d2ec1f3b9dcc1c42b062f67da239a47d4904d313c55a
- SSDEEP 12288:7RUQ/DK21WSRL3oXY+/zNi7Dha0pePTvJRXYBVMAqn4jNZYXm0ipZWZPA76:77zXL3oXVw700pe7zXYBVgn4jNZYXdi7
- MD5 SHA1 SHA512 SSDEEP