Overview

overview

10

Static

static

72af8c1ffb...d8.exe

windows7-x64

10

72af8c1ffb...d8.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    178s
  • max time network
    191s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20221111-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
  • submitted
    24-11-2022 23:50

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    72af8c1ffb7498fbea76c5f9704b798043a88875c460bfb43cc9085f841e7fd8.exe

  • Size

    71KB

  • MD5

    d6f1148158f46d5d845d0fd4b77ab44b

  • SHA1

    51eb682f1b0b186ac86329cf65e3c70cee195178

  • SHA256

    72af8c1ffb7498fbea76c5f9704b798043a88875c460bfb43cc9085f841e7fd8

  • SHA512

    38f02436a46fbaa0970871c169051ea50dc9d3349cf025ecb6d2938ce83b61610d3d1aaf58c45d08468f9400c4dddb3587c8f103b08693596ff7b4acfccc9914

  • SSDEEP

    768:eme0+LDFxI0xlMBBXwZmdWlBUUoArbMwCdJooWYAT1rak8aIHUm+MlXKCbF9+ljK:+0sIyOkllfoAPN+eoouq8HwjK

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 1 IoCs
    evasiontrojan
  • Adds policy Run key to start application 2 TTPs 2 IoCs
    persistence
  • Blocklisted process makes network request 1 IoCs
  • Disables taskbar notifications via registry modification
    evasion
  • Maps connected drives based on registry 3 TTPs 2 IoCs

    Disk information is often read in order to detect sandboxing environments.

  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 1 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: MapViewOfSection 64 IoCs
  • Suspicious use of AdjustPrivilegeToken 3 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 13 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\72af8c1ffb7498fbea76c5f9704b798043a88875c460bfb43cc9085f841e7fd8.exe
    "C:\Users\Admin\AppData\Local\Temp\72af8c1ffb7498fbea76c5f9704b798043a88875c460bfb43cc9085f841e7fd8.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    PID:1136
    • C:\Users\Admin\AppData\Local\Temp\72af8c1ffb7498fbea76c5f9704b798043a88875c460bfb43cc9085f841e7fd8.exe
      "C:\Users\Admin\AppData\Local\Temp\72af8c1ffb7498fbea76c5f9704b798043a88875c460bfb43cc9085f841e7fd8.exe"
      2⤵
      • Maps connected drives based on registry
      • Suspicious behavior: EnumeratesProcesses
      • Suspicious behavior: MapViewOfSection
      • Suspicious use of WriteProcessMemory
      PID:1788
      • C:\Windows\SysWOW64\msiexec.exe
        C:\Windows\SysWOW64\msiexec.exe
        3⤵
        • UAC bypass
        • Adds policy Run key to start application
        • Blocklisted process makes network request
        • Drops file in Program Files directory
        • Suspicious behavior: EnumeratesProcesses
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of AdjustPrivilegeToken
        • Suspicious use of WriteProcessMemory
        PID:5052
        • C:\Windows\SysWOW64\msiexec.exe
          "C:\Windows\SysWOW64\msiexec.exe"
          4⤵
            PID:3856

    Network

    MITRE ATT&CK Matrix ATT&CK v6

    Initial Access

    Execution

    Persistence

    Registry Run Keys / Startup Folder

    1
    T1060

    Privilege Escalation

    Bypass User Account Control

    1
    T1088

    Defense Evasion

    Bypass User Account Control

    1
    T1088

    Disabling Security Tools

    1
    T1089

    Modify Registry

    2
    T1112

    Credential Access

    Discovery

    Query Registry

    1
    T1012

    Peripheral Device Discovery

    1
    T1120

    System Information Discovery

    1
    T1082

    Lateral Movement

    Collection

    Exfiltration

    Command and Control

    Impact

    Replay Monitor

    Loading Replay Monitor...

    Downloads

    • \??\c:\progra~3\msiawtua.exe
      Filesize

      71KB

      MD5

      d6f1148158f46d5d845d0fd4b77ab44b

      SHA1

      51eb682f1b0b186ac86329cf65e3c70cee195178

      SHA256

      72af8c1ffb7498fbea76c5f9704b798043a88875c460bfb43cc9085f841e7fd8

      SHA512

      38f02436a46fbaa0970871c169051ea50dc9d3349cf025ecb6d2938ce83b61610d3d1aaf58c45d08468f9400c4dddb3587c8f103b08693596ff7b4acfccc9914

      Download Submit
    • memory/1788-134-0x0000000000000000-mapping.dmp
      Download
    • memory/1788-135-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

      Download
    • memory/1788-137-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

      Download
    • memory/1788-138-0x0000000000400000-0x0000000000407000-memory.dmp
      Filesize

      28KB

      Download
    • memory/3856-143-0x0000000000000000-mapping.dmp
      Download
    • memory/5052-139-0x0000000000000000-mapping.dmp
      Download
    • memory/5052-140-0x00000000005B0000-0x00000000005C2000-memory.dmp
      Filesize

      72KB

      Download
    • memory/5052-141-0x00000000009D0000-0x00000000009D7000-memory.dmp
      Filesize

      28KB

      Download
    • memory/5052-142-0x000000007FB30000-0x000000007FB37000-memory.dmp
      Filesize

      28KB

      Download