Overview

overview

10

Static

static

dc154690af...63.exe

windows7-x64

10

dc154690af...63.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    137s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    19-10-2022 21:31

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    dc154690af2797f3ef92f860c4deb7aecde24af6c31cf74435b8a5b0e1618c63.exe

  • Size

    294KB

  • MD5

    91045333f53d3f0de734d2125cea4adc

  • SHA1

    10c4186201be8b9935ab6a65907e4c36f1e1bac2

  • SHA256

    dc154690af2797f3ef92f860c4deb7aecde24af6c31cf74435b8a5b0e1618c63

  • SHA512

    28f0ceb68bdb116f08d79a950980ba88d8e311755c4f62b0ddd821449d4ae887790f7b24408790e9cab79d66a5548e484af4a9b65f8811ac6d4f5654f09c90bb

  • SSDEEP

    3072:3AHaEWRQgt268R0qI59sY9dLvEnj5bJApXtQp8ikQwIerUzg/kz7GtQ6Qv6eZiIn:gaQmRM5WIMgg8L6svZ58egcS

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 20 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 22 IoCs
  • NTFS ADS 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\dc154690af2797f3ef92f860c4deb7aecde24af6c31cf74435b8a5b0e1618c63.exe
    "C:\Users\Admin\AppData\Local\Temp\dc154690af2797f3ef92f860c4deb7aecde24af6c31cf74435b8a5b0e1618c63.exe"
    1⤵
    • Modifies security service
    • Sets service image path in registry
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1716
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Deletes itself
      PID:1516

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Program Files (x86)\Google\Desktop\Install\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\ \...\‮ﯹ๛\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\@
    Filesize

    2KB

    MD5

    15c4d9ace2e5f6514173925c903c3f1d

    SHA1

    e3256d81908415a60ec9e027a2375fd44c7f1307

    SHA256

    70e0e3c620c8a352559f86e757d76e90dec22b1feb5751cabcc80e7450e60f7b

    SHA512

    e080a37489298e4b02886725c86cd9b029dc09158f9bdf97475bb72f539761d02f5fe47b9f5821e6eaf38f0e7e6b42dcce60ece610f14cf0f78dddee44579e17

    Download Submit

  • memory/472-59-0x00000000000F0000-0x0000000000102000-memory.dmp

    Filesize

    72KB

    Download

  • memory/472-63-0x00000000000F0000-0x0000000000102000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1224-58-0x0000000002A20000-0x0000000002A32000-memory.dmp

    Filesize

    72KB

    Download

  • memory/1716-54-0x00000000765B1000-0x00000000765B3000-memory.dmp

    Filesize

    8KB

    Download

  • memory/1716-55-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1716-56-0x00000000005E0000-0x0000000000606000-memory.dmp

    Filesize

    152KB

    Download

  • memory/1716-57-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

    Download

  • memory/1716-61-0x0000000000400000-0x000000000044C000-memory.dmp

    Filesize

    304KB

    Download