Analysis

  • max time kernel
    132s
  • max time network
    146s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    07/11/2022, 09:58

General

  • Target

    e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe

  • Size

    121KB

  • MD5

    0d651f176a0f1b2659a0f6f578ceb1f1

  • SHA1

    198b746ca2c0272e03717c52fe089716313ae62c

  • SHA256

    e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66

  • SHA512

    171f6d8c2fce3cdd4b59de425266e9770e0a248d9f7a39d201e341b86d02b6dcca20ba685450be3e3a45f67e5e1a300ed414166cbeadd189b545b630ce5cd44e

  • SSDEEP

    3072:0tJ6Ypo3U3zGNCgDvKz1jYjfiS4dTCGv:m83iaCgDymP6Cc

Score
7/10

Malware Config

Signatures

  • Deletes itself 1 IoCs
  • Adds Run key to start application 2 TTPs 2 IoCs
  • Enumerates connected drives 3 TTPs 24 IoCs

    Attempts to read the root path of hard drives other than the default C: drive.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Windows directory 1 IoCs
  • Modifies Internet Explorer settings 1 TTPs 28 IoCs
  • Suspicious behavior: EnumeratesProcesses 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 5 IoCs
  • Suspicious use of FindShellTrayWindow 1 IoCs
  • Suspicious use of SetWindowsHookEx 10 IoCs
  • Suspicious use of WriteProcessMemory 39 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe
    "C:\Users\Admin\AppData\Local\Temp\e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of WriteProcessMemory
    PID:1696
    • C:\Windows\SysWOW64\svchost.exe
      "C:\Windows\system32\svchost.exe"
      2⤵
      • Enumerates connected drives
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:940
      • C:\Windows\SysWOW64\mspaint.exe
        "C:\Windows\system32\mspaint.exe"
        3⤵
        • Deletes itself
        • Adds Run key to start application
        • Enumerates connected drives
        • Drops file in Windows directory
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of SetWindowsHookEx
        PID:1720
    • C:\Users\Admin\AppData\Local\Temp\e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe
      "C:\Users\Admin\AppData\Local\Temp\e036b18e95697132235622eb0d29f30257cc783105ce8e0e13ebe2204a106c66.exe"
      2⤵
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious use of AdjustPrivilegeToken
      • Suspicious use of WriteProcessMemory
      PID:1960
      • C:\Program Files (x86)\Internet Explorer\iexplore.exe
        "C:\Program Files (x86)\Internet Explorer\iexplore.exe"
        3⤵
        • Suspicious use of WriteProcessMemory
        PID:1196
        • C:\Program Files\Internet Explorer\IEXPLORE.EXE
          "C:\Program Files\Internet Explorer\IEXPLORE.EXE"
          4⤵
          • Modifies Internet Explorer settings
          • Suspicious use of FindShellTrayWindow
          • Suspicious use of SetWindowsHookEx
          • Suspicious use of WriteProcessMemory
          PID:992
          • C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE
            "C:\Program Files (x86)\Internet Explorer\IEXPLORE.EXE" SCODEF:992 CREDAT:275457 /prefetch:2
            5⤵
            • Modifies Internet Explorer settings
            • Suspicious use of AdjustPrivilegeToken
            • Suspicious use of SetWindowsHookEx
            PID:1092

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LH5412AK.txt

    Filesize

    608B

    MD5

    c6bad4e47d2e232a31c9e9a16f6289bb

    SHA1

    d264a91b96f43206cb1a924165b6b5a69e60e5c7

    SHA256

    6cfc42bce8f06690ff1afcdcad3a6cda2afa8cd69fccc277a5c9e644e0379a00

    SHA512

    efcf21ac3925057aba84db6a983cab02173510afdd5e44799c764279a874f832cf74173bc8559ea141d2b4102804a1020da7ede62719c01ad66f8660f6fd9669

  • memory/940-117-0x0000000000330000-0x000000000037E000-memory.dmp

    Filesize

    312KB

  • memory/940-57-0x0000000000080000-0x00000000000A1000-memory.dmp

    Filesize

    132KB

  • memory/940-303-0x0000000000330000-0x000000000037E000-memory.dmp

    Filesize

    312KB

  • memory/940-123-0x0000000000330000-0x000000000037E000-memory.dmp

    Filesize

    312KB

  • memory/940-78-0x0000000000080000-0x00000000000A1000-memory.dmp

    Filesize

    132KB

  • memory/940-111-0x0000000000330000-0x000000000037E000-memory.dmp

    Filesize

    312KB

  • memory/940-105-0x0000000000330000-0x000000000037E000-memory.dmp

    Filesize

    312KB

  • memory/940-99-0x0000000000330000-0x000000000037E000-memory.dmp

    Filesize

    312KB

  • memory/940-94-0x0000000000330000-0x000000000037E000-memory.dmp

    Filesize

    312KB

  • memory/940-88-0x0000000000330000-0x000000000037E000-memory.dmp

    Filesize

    312KB

  • memory/940-85-0x0000000000330000-0x000000000037E000-memory.dmp

    Filesize

    312KB

  • memory/1696-73-0x0000000000400000-0x0000000000700000-memory.dmp

    Filesize

    3.0MB

  • memory/1696-74-0x0000000000220000-0x0000000000234000-memory.dmp

    Filesize

    80KB

  • memory/1696-55-0x0000000000400000-0x0000000000700000-memory.dmp

    Filesize

    3.0MB

  • memory/1696-54-0x00000000766D1000-0x00000000766D3000-memory.dmp

    Filesize

    8KB

  • memory/1720-305-0x0000000004238000-0x000000000423A000-memory.dmp

    Filesize

    8KB

  • memory/1720-81-0x0000000000BA1000-0x0000000000BA3000-memory.dmp

    Filesize

    8KB

  • memory/1720-110-0x0000000004200000-0x000000000424E000-memory.dmp

    Filesize

    312KB

  • memory/1720-304-0x0000000004200000-0x000000000424E000-memory.dmp

    Filesize

    312KB

  • memory/1720-294-0x0000000004238000-0x000000000423A000-memory.dmp

    Filesize

    8KB

  • memory/1720-98-0x0000000004200000-0x000000000424E000-memory.dmp

    Filesize

    312KB

  • memory/1720-138-0x0000000004200000-0x000000000424E000-memory.dmp

    Filesize

    312KB

  • memory/1720-104-0x0000000004200000-0x000000000424E000-memory.dmp

    Filesize

    312KB

  • memory/1720-122-0x0000000004200000-0x000000000424E000-memory.dmp

    Filesize

    312KB

  • memory/1720-116-0x0000000004200000-0x000000000424E000-memory.dmp

    Filesize

    312KB

  • memory/1960-70-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1960-66-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1960-115-0x00000000003A0000-0x00000000003EE000-memory.dmp

    Filesize

    312KB

  • memory/1960-68-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1960-61-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1960-121-0x00000000003A0000-0x00000000003EE000-memory.dmp

    Filesize

    312KB

  • memory/1960-103-0x00000000003A0000-0x00000000003EE000-memory.dmp

    Filesize

    312KB

  • memory/1960-64-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1960-109-0x00000000003A0000-0x00000000003EE000-memory.dmp

    Filesize

    312KB

  • memory/1960-255-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1960-279-0x00000000003A0000-0x00000000003EE000-memory.dmp

    Filesize

    312KB

  • memory/1960-97-0x00000000003A0000-0x00000000003EE000-memory.dmp

    Filesize

    312KB

  • memory/1960-62-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1960-77-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB

  • memory/1960-93-0x00000000003A0000-0x00000000003EE000-memory.dmp

    Filesize

    312KB

  • memory/1960-76-0x0000000000400000-0x000000000044E000-memory.dmp

    Filesize

    312KB