Overview

overview

10

Static

static

f28fb3dd48...96.exe

windows7-x64

10

f28fb3dd48...96.exe

windows10-2004-x64

1

Analysis

  • max time kernel
    170s
  • max time network
    215s
  • platform
    windows7_x64
  • resource
    win7-20220812-en
  • resource tags

    arch:x64arch:x86image:win7-20220812-enlocale:en-usos:windows7-x64system
  • submitted
    07-11-2022 09:29

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    f28fb3dd487a30b0d3e264e91625e42b691acb5294b7c352885c4c0ca233a296.exe

  • Size

    164KB

  • MD5

    06f744177562835221859dca4978a096

  • SHA1

    c6db5f235ac1654977f4ead44a87a2091f2723b3

  • SHA256

    f28fb3dd487a30b0d3e264e91625e42b691acb5294b7c352885c4c0ca233a296

  • SHA512

    87c1e1a09fce28ca215653604da52e5445b4ed1bee6f62c339f07e0269aecea0f5f7b175a6fa715026b1eac47e602e3a1b1296ad89044f6a9a89a1500a8fcf8f

  • SSDEEP

    3072:bC3qSH6EGpagDo3yC0XNJq5LLPImpyfyBg44aG5WpkqAnM4qy:b9Daao3yxNJkL/yfWgmGcphvdy

Score
10/10
evasion

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 26 IoCs
    evasion
  • Drops desktop.ini file(s) 2 IoCs
  • Drops file in Windows directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 7 IoCs
  • Suspicious use of AdjustPrivilegeToken 29 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 2 IoCs

Processes

  • C:\Windows\system32\services.exe
    C:\Windows\system32\services.exe
    1⤵
    • Modifies firewall policy service
    • Modifies security service
    • Drops desktop.ini file(s)
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    PID:464
  • C:\Windows\Explorer.EXE
    C:\Windows\Explorer.EXE
    1⤵
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of FindShellTrayWindow
    • Suspicious use of SendNotifyMessage
    PID:1256
    • C:\Users\Admin\AppData\Local\Temp\f28fb3dd487a30b0d3e264e91625e42b691acb5294b7c352885c4c0ca233a296.exe
      "C:\Users\Admin\AppData\Local\Temp\f28fb3dd487a30b0d3e264e91625e42b691acb5294b7c352885c4c0ca233a296.exe"
      2⤵
      • Drops file in Windows directory
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:952

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • \systemroot\Installer\{bb8ab67a-d838-2496-fd4e-ead6952e3208}\@
    Filesize

    2KB

    MD5

    1ad3a4e96834c7981b380892ca9d469d

    SHA1

    d6e3b47234b0e03ff0e024c16c8dd057bf4f80e3

    SHA256

    11d29e8c54743e54f47947feb4dac120505b2ccdaaf82bf541720c8335fb797d

    SHA512

    b63d01fac24cd2cdda912b138824ec3d25843e539b1bf0b88190c21d53711ae75e82ce8d7edbefa310b6730d7c410350117cba11e41cb6e1a6a7908d37b9ac68

    Download Submit

  • memory/464-62-0x0000000000120000-0x000000000012F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/464-58-0x0000000000120000-0x000000000012F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/464-54-0x0000000000120000-0x000000000012F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/464-65-0x0000000000130000-0x000000000013F000-memory.dmp

    Filesize

    60KB

    Download

  • memory/464-64-0x00000000000F0000-0x00000000000FB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/464-66-0x00000000000F0000-0x00000000000FB000-memory.dmp

    Filesize

    44KB

    Download

  • memory/464-67-0x0000000000130000-0x000000000013F000-memory.dmp

    Filesize

    60KB

    Download