Analysis
-
max time kernel
193s -
max time network
244s -
platform
windows7_x64 -
resource
win7-20221111-en -
resource tags
arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system -
submitted
26-11-2022 09:02
Static task
static1
Behavioral task
behavioral1
Sample
2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe
Resource
win7-20221111-en
Behavioral task
behavioral2
Sample
2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe
Resource
win10v2004-20220901-en
General
-
Target
2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe
-
Size
420KB
-
MD5
140c256bfc0683adb84d71785610e2d4
-
SHA1
777fba4bbeba7c8fd68bb962436254eae4eb7294
-
SHA256
2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57
-
SHA512
fbce23ef5babd1785c6b3ab35079a5d99b9fdd9724425aee92ea9f7bd054ea920228c9947347056f9438a155a9c0a85698100a003b8eb634b8da467f9c3018b6
-
SSDEEP
12288:PlBelJGyZ8wlvJCMt7sCBI4vAJ1Jvs9P:90l4ydBCyK4vih
Malware Config
Signatures
-
Adds Run key to start application 2 TTPs 2 IoCs
Processes:
2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exedescription ioc process Key created \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run 2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe Set value (str) \REGISTRY\USER\S-1-5-21-3406023954-474543476-3319432036-1000\Software\Microsoft\Windows\CurrentVersion\Run\ = "C:\\Users\\Admin\\AppData\\Local\\Temp\\2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe" 2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe -
Suspicious behavior: EnumeratesProcesses 2 IoCs
Processes:
2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exepid process 1664 2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe 1664 2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe -
Suspicious behavior: GetForegroundWindowSpam 1 IoCs
Processes:
pid process 1244 -
Suspicious behavior: MapViewOfSection 1 IoCs
Processes:
2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exepid process 1664 2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe -
Suspicious use of AdjustPrivilegeToken 1 IoCs
Processes:
description pid process Token: SeDebugPrivilege 1244 -
Suspicious use of FindShellTrayWindow 2 IoCs
Processes:
pid process 1244 1244 -
Suspicious use of SendNotifyMessage 2 IoCs
Processes:
pid process 1244 1244 -
Suspicious use of SetWindowsHookEx 2 IoCs
Processes:
2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exepid process 1664 2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe 1664 2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe -
Suspicious use of UnmapMainImage 1 IoCs
Processes:
2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exepid process 1664 2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe
Processes
-
C:\Users\Admin\AppData\Local\Temp\2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe"C:\Users\Admin\AppData\Local\Temp\2c6e63a2d367128048b73fde594c509b9cee39f89d81d8f3c1512a7777e22a57.exe"1⤵
- Adds Run key to start application
- Suspicious behavior: EnumeratesProcesses
- Suspicious behavior: MapViewOfSection
- Suspicious use of SetWindowsHookEx
- Suspicious use of UnmapMainImage
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
memory/1244-59-0x0000000003BF0000-0x0000000003C23000-memory.dmpFilesize
204KB
-
memory/1244-58-0x0000000002CC0000-0x0000000002CEF000-memory.dmpFilesize
188KB
-
memory/1664-54-0x0000000075C81000-0x0000000075C83000-memory.dmpFilesize
8KB
-
memory/1664-55-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB
-
memory/1664-57-0x0000000000400000-0x0000000000469000-memory.dmpFilesize
420KB
-
memory/1664-60-0x0000000000400000-0x000000000044F000-memory.dmpFilesize
316KB