Overview

overview

10

Static

static

10

HEUR-Troja...71.exe

windows7-x64

8

HEUR-Troja...71.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    149s
  • max time network
    152s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    21-09-2022 15:10

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    HEUR-Trojan.Win32.Generic-4cd9ec4e08542ffeb71.exe

  • Size

    37KB

  • MD5

    1932439d302e56c637f6e1ae6a994a16

  • SHA1

    3507440117305f02e1b83d0995dddbacd7a36d8e

  • SHA256

    4cd9ec4e08542ffeb71acb653813fe354a23d8960f031d488ff25b54730d5b64

  • SHA512

    1f41b35e5f36709d72496e53322773d5ad167a96081ccfdb70a174a637e9919712d9960d1ef6a7f32ee6ba7948d720bbf1efb1893e21ce38a84d9ac9349576e8

  • SSDEEP

    384:5kNWY2giHF19JvubMcKyMTcyPZITHe2CrAF+rMRTyN/0L+EcoinblneHQM3epzXr:WNWTTvJc5MTcymzehrM+rMRa8NuU6t

Score
8/10
evasion

Malware Config

Signatures

  • Modifies Windows Firewall 1 TTPs 1 IoCs
    evasion
  • Suspicious use of AdjustPrivilegeToken 35 IoCs
  • Suspicious use of WriteProcessMemory 3 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-4cd9ec4e08542ffeb71.exe
    "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-4cd9ec4e08542ffeb71.exe"
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:3532
    • C:\Windows\SysWOW64\netsh.exe
      netsh firewall add allowedprogram "C:\Users\Admin\AppData\Local\Temp\HEUR-Trojan.Win32.Generic-4cd9ec4e08542ffeb71.exe" "HEUR-Trojan.Win32.Generic-4cd9ec4e08542ffeb71.exe" ENABLE
      2⤵
      • Modifies Windows Firewall
      PID:2376

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Modify Existing Service

1
T1031

Privilege Escalation

Defense Evasion

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/2376-133-0x0000000000000000-mapping.dmp
    Download
  • memory/3532-132-0x0000000074B90000-0x0000000075141000-memory.dmp
    Filesize

    5.7MB

    Download
  • memory/3532-134-0x0000000074B90000-0x0000000075141000-memory.dmp
    Filesize

    5.7MB

    Download