daa8802270996f3d7b4835fd9fba42da054ad1a58403854c0f86b0666c631ac1

Analysis

max time kernel
143s
max time network
174s
platform
windows10-2004_x64
resource
win10v2004-20221111-en
resource tags

arch:x64arch:x86image:win10v2004-20221111-enlocale:en-usos:windows10-2004-x64system
submitted
26/11/2022, 11:26 UTC

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

107.exe
Size

8KB
MD5

339e4181fe7c160461c885faf5e6fd14
SHA1

b90c1adb7483723b177aca3e423119f5c3803a11
SHA256

403a36221ba0f7f94c0fd180058d033215ec3a0cbbd9cf18dc573ca312dae3a6
SHA512

e3adf3a194b7a7d02b64a0f1e0b5c5315d02f6f501c77cc07a97d5a4a24f200bba5d5080d5205fe8ff6a59e282e0f3946410e548c09f54e0ce277b078d8df662
SSDEEP

96:q2Imfd/26jgx0G60G9kSfkYGol8NDOFs8yoGvhUko9+r5M/24q9eRY0bqOi:q4fdSxK0akSTV4LhNo9w2awOO

Score

6^/10

Malware Config

Signatures

Legitimate hosting services abused for malware hosting/C2 1 TTPs

Web Service
T1102

Checks processor information in registry 2 TTPs 3 IoCs

Processor information is often read in order to detect sandboxing environments.

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString	dw20.exe

Enumerates system info in registry 2 TTPs 2 IoCs

Query Registry

T1012

System Information Discovery

T1082

description	ioc	Process
Key opened	\REGISTRY\MACHINE\Hardware\Description\System\BIOS	dw20.exe
Key value queried	\REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU	dw20.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeBackupPrivilege	380	dw20.exe
Token: SeBackupPrivilege	380	dw20.exe

Suspicious use of WriteProcessMemory 2 IoCs

description	pid	Process	procid_target
PID 1376 wrote to memory of 380	1376	107.exe	91
PID 1376 wrote to memory of 380	1376	107.exe	91

C:\Users\Admin\AppData\Local\Temp\107.exe
"C:\Users\Admin\AppData\Local\Temp\107.exe"
1⤵
- Suspicious use of WriteProcessMemory
PID:1376
- C:\Windows\Microsoft.NET\Framework64\v2.0.50727\dw20.exe
  dw20.exe -x -s 1352
  2⤵
  - Checks processor information in registry
  - Enumerates system info in registry
  - Suspicious use of AdjustPrivilegeToken
  PID:380

Network

DNS

pastebin.com

107.exe

Remote address:

8.8.8.8:53

Request

pastebin.com

IN A

Response

pastebin.com

IN A

104.20.68.143

pastebin.com

IN A

104.20.67.143

pastebin.com

IN A

172.67.34.170
DNS

15.89.54.20.in-addr.arpa

Remote address:

8.8.8.8:53

Request

15.89.54.20.in-addr.arpa

IN PTR

Response
DNS

7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

Remote address:

8.8.8.8:53

Request

7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

IN PTR

Response

72.21.81.240:80

46 B
40 B
1
1
72.21.81.240:80

46 B
40 B
1
1
72.21.81.240:80

46 B
40 B
1
1
209.197.3.8:80

322 B
7
209.197.3.8:80

260 B
5
209.197.3.8:80

260 B
5
104.80.225.205:443

322 B
7
52.168.112.66:443

322 B
7
209.197.3.8:80

322 B
7
209.197.3.8:80

322 B
7
209.197.3.8:80

322 B
7
40.125.122.151:443

260 B
5
40.126.32.133:443

260 B
5
104.20.68.143:80

pastebin.com

107.exe

260 B
5
20.190.160.17:443

260 B
5
104.20.67.143:80

pastebin.com

107.exe

260 B
5
172.67.34.170:80

pastebin.com

107.exe

260 B
5

8.8.8.8:53

pastebin.com

dns

107.exe

58 B
106 B
1
1

DNS Request

pastebin.com

DNS Response

104.20.68.143

104.20.67.143

172.67.34.170
8.8.8.8:53

15.89.54.20.in-addr.arpa

dns

70 B
156 B
1
1

DNS Request

15.89.54.20.in-addr.arpa
8.8.8.8:53

7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

dns

118 B
204 B
1
1

DNS Request

7.6.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.0.0.0.2.0.0.0.0.2.0.1.3.0.6.2.ip6.arpa

MITRE ATT&CK Enterprise v6

Initial Access

Execution

Persistence

Privilege Escalation

Defense Evasion

Web Service

T1102

Credential Access

Discovery

Query Registry

T1012

System Information Discovery

T1082

Lateral Movement

Collection

Command and Control

Web Service

T1102

Exfiltration

Impact

Replay Monitor

Loading Replay Monitor...

Downloads

memory/1376-132-0x00007FFD8A680000-0x00007FFD8B0B6000-memory.dmp

Filesize
10.2MB

Download

Analysis

Sharing

General

Malware Config

Signatures

Processes

Network

DNS Request

DNS Response

DNS Request

DNS Request

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

We care about your privacy.