Overview

overview

8

Static

static

7cfab5299b...78.exe

windows7-x64

8

7cfab5299b...78.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    150s
  • max time network
    109s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    02/10/2022, 13:04

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    7cfab5299b7f6362151a7eab77102d7abc2f6c9d85773004103f546b93af9a78.exe

  • Size

    181KB

  • MD5

    635225e40d1ab681b657b5e21dd23f32

  • SHA1

    6c2ea698bdfb75d8c976a204d9dbafd7487eee93

  • SHA256

    7cfab5299b7f6362151a7eab77102d7abc2f6c9d85773004103f546b93af9a78

  • SHA512

    fc77ed1546df1ddf4e13d892f54d7f0acf7dca15ee62a9e25ab1694f53eaaab3e954780b060c61c960b066db0a46f5ba77c83f941ff2b9ccf929258a162d1dd8

  • SSDEEP

    3072:Q9lHbd/xC9lcdk7VrveYRsYNqDrZCG5GUrKBq4YsPmSq5sCsP6kEt9ofCESsRRcE:Qfbd/xC9r73WogrZ95GUrAq4LatYVBSY

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Registers COM server for autorun 1 TTPs 3 IoCs
    persistence
  • Unexpected DNS network traffic destination 5 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Modifies registry class 5 IoCs
  • Suspicious behavior: EnumeratesProcesses 10 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 4 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Executes dropped EXE
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    PID:2440
    • C:\Users\Admin\AppData\Local\Temp\7cfab5299b7f6362151a7eab77102d7abc2f6c9d85773004103f546b93af9a78.exe
      "C:\Users\Admin\AppData\Local\Temp\7cfab5299b7f6362151a7eab77102d7abc2f6c9d85773004103f546b93af9a78.exe"
      2⤵
      • Registers COM server for autorun
      • Modifies registry class
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:3920

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\$bfcb9398bfb2ca3f1731e604ea3da242\n
          Filesize

          41KB

          MD5

          fb4e3236959152a057bc6b7603c538ef

          SHA1

          b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

          SHA256

          8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

          SHA512

          993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

          Download Submit

        • C:\$Recycle.Bin\S-1-5-21-929662420-1054238289-2961194603-1000\$bfcb9398bfb2ca3f1731e604ea3da242\n
          Filesize

          41KB

          MD5

          fb4e3236959152a057bc6b7603c538ef

          SHA1

          b25a70c07dd2eb1c9fdf89f7a2ffc286f226edf4

          SHA256

          8244ddfcba327a3f67a5582642c53241ee5e58d75808547cd74808bcded272d0

          SHA512

          993dbfbf71394ad1f120a8687d57eac2b9a55b11b1594aadd5a8d90edc0a26e5fd21f78317d342837ce27728613b5fc9c6ea40f86d17e5c477071be84f8aa3d2

          Download Submit

        • memory/3920-134-0x0000000000400000-0x0000000000432000-memory.dmp

          Filesize

          200KB

          Download

        • memory/3920-135-0x00000000009F0000-0x0000000000A7D000-memory.dmp

          Filesize

          564KB

          Download

        • memory/3920-136-0x00000000009F0000-0x0000000000A22000-memory.dmp

          Filesize

          200KB

          Download