Overview

overview

8

Static

static

919de11e3b...af.exe

windows7-x64

8

919de11e3b...af.exe

windows10-2004-x64

8

Analysis

  • max time kernel
    154s
  • max time network
    157s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220812-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220812-enlocale:en-usos:windows10-2004-x64system
  • submitted
    23-11-2022 13:39

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    919de11e3ba65b19b6b2c36501182369c16e5073505e25db5d07da1d20475baf.exe

  • Size

    114KB

  • MD5

    32076c70f4bed33da3e9f54a9feb0ef1

  • SHA1

    b550c459d0e9d41307b11fd2af05f789645de412

  • SHA256

    919de11e3ba65b19b6b2c36501182369c16e5073505e25db5d07da1d20475baf

  • SHA512

    5147ca816f8db22a637d99da6af418245792c6e5b3f538d166cb4c5c18da9b723cccb81a786c70b934d7d70ca841dbd839ea850567bbdafbd549b1506b1b3fdd

  • SSDEEP

    3072:zx/vggcs61z2fTkA8TM/BlV2td4WetIfHDv:V/vgg5618TQTgBlUtHTf

Score
8/10
persistence

Malware Config

Signatures

  • Executes dropped EXE 1 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
    persistence
  • Suspicious use of SetThreadContext 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of WriteProcessMemory 10 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\919de11e3ba65b19b6b2c36501182369c16e5073505e25db5d07da1d20475baf.exe
    "C:\Users\Admin\AppData\Local\Temp\919de11e3ba65b19b6b2c36501182369c16e5073505e25db5d07da1d20475baf.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1168
    • C:\WINDOWS\SysWOW64\svchost.exe
      "C:\WINDOWS\SysWOW64\svchost.exe"
      2⤵
      • Adds Run key to start application
      PID:1636
    • C:\WINDOWS\SysWOW64\svchost.exe
      "C:\WINDOWS\SysWOW64\svchost.exe"
      2⤵
      • Suspicious use of WriteProcessMemory
      PID:3148
      • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\svchost.exe
        "C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\svchost.exe"
        3⤵
        • Executes dropped EXE
        • Adds Run key to start application
        • Suspicious behavior: EnumeratesProcesses
        PID:3448

Network

MITRE ATT&CK Matrix ATT&CK v6

Initial Access

Execution

Persistence

Registry Run Keys / Startup Folder

1
T1060

Privilege Escalation

Defense Evasion

Modify Registry

1
T1112

Credential Access

Discovery

Lateral Movement

Collection

Exfiltration

Command and Control

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\Low\svchost.exe
    Filesize

    57KB

    MD5

    170ffc6912056096a1bc0a91e75740aa

    SHA1

    cebcae1708cee825f2f789fbb82888fbed60741f

    SHA256

    70c4b88b0fe7bcce2af27c68b2c53201ffe55df8c9eba6a7b6f6820b08e4f8bb

    SHA512

    915ebb4cdb9948e042a3022cfdadfccfd665022207b00918c48061c89e5b2e147d30de9a49e10220577978042da063726d0122361d8ad2adcea7bbf6f05e1034

    Download Submit
  • C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\svchost.exe
    Filesize

    57KB

    MD5

    170ffc6912056096a1bc0a91e75740aa

    SHA1

    cebcae1708cee825f2f789fbb82888fbed60741f

    SHA256

    70c4b88b0fe7bcce2af27c68b2c53201ffe55df8c9eba6a7b6f6820b08e4f8bb

    SHA512

    915ebb4cdb9948e042a3022cfdadfccfd665022207b00918c48061c89e5b2e147d30de9a49e10220577978042da063726d0122361d8ad2adcea7bbf6f05e1034

    Download Submit
  • memory/1636-132-0x0000000000000000-mapping.dmp
    Download
  • memory/1636-133-0x0000000001290000-0x00000000012B3000-memory.dmp
    Filesize

    140KB

    Download
  • memory/3148-134-0x0000000000000000-mapping.dmp
    Download
  • memory/3148-135-0x0000000000C90000-0x0000000000CB3000-memory.dmp
    Filesize

    140KB

    Download
  • memory/3448-136-0x0000000000000000-mapping.dmp
    Download