Overview

overview

10

Static

static

185c3eee72...b3.exe

windows7-x64

10

185c3eee72...b3.exe

windows10-2004-x64

10

Analysis

  • max time kernel
    261s
  • max time network
    336s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    27-11-2022 16:38

Sharing

Copy URL
Twitter E-mail
Report Analysis Logs

General

  • Target

    185c3eee720b39d451eabaf825599432857f1ffa6f63c0fb6e93424134851eb3.exe

  • Size

    189KB

  • MD5

    6f1cd243ff52889a4759ef7f096c4b68

  • SHA1

    f1f9d7abcb18a5cd79e2e72e59171927ea581cdf

  • SHA256

    185c3eee720b39d451eabaf825599432857f1ffa6f63c0fb6e93424134851eb3

  • SHA512

    4212c09605e101ba2abfa2c4ba63dd40f6ea0a24bc75349c7d1207ccbeaef3b3dd2b68e5028794ae1f1ccdfd31c1a31140dba0bfd20716412b6b150c877df399

  • SSDEEP

    3072:7VcB6MI65YS2gCh6aDBOfqy0zVOUxALupWGjolObTVtgX4p:mfYbjnDMfq9OUxku0GzTVA4p

Score
10/10
evasionpersistencetrojan

Malware Config

Signatures

  • UAC bypass 3 TTPs 2 IoCs
    evasiontrojan
  • Disables RegEdit via registry modification 1 IoCs
    evasion
  • Disables Task Manager via registry modification
    evasion
  • Drops file in Drivers directory 1 IoCs
  • Adds Run key to start application 2 TTPs 1 IoCs
    persistence
  • Checks whether UAC is enabled 1 TTPs 2 IoCs
    evasiontrojan
  • Drops file in Program Files directory 2 IoCs
  • Modifies registry key 1 TTPs 2 IoCs
  • Suspicious behavior: EnumeratesProcesses 64 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious use of AdjustPrivilegeToken 1 IoCs
  • Suspicious use of SetWindowsHookEx 1 IoCs
  • Suspicious use of WriteProcessMemory 6 IoCs
  • System policy modification 1 TTPs 2 IoCs
    evasion

Processes

  • C:\Users\Admin\AppData\Local\Temp\185c3eee720b39d451eabaf825599432857f1ffa6f63c0fb6e93424134851eb3.exe
    "C:\Users\Admin\AppData\Local\Temp\185c3eee720b39d451eabaf825599432857f1ffa6f63c0fb6e93424134851eb3.exe"
    1⤵
    • UAC bypass
    • Drops file in Drivers directory
    • Adds Run key to start application
    • Checks whether UAC is enabled
    • Drops file in Program Files directory
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: GetForegroundWindowSpam
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of SetWindowsHookEx
    • Suspicious use of WriteProcessMemory
    • System policy modification
    PID:544
    • C:\Windows\system32\REG.exe
      REG add HKCU\Software\Microsoft\Windows\CurrentVersion\Policies\System /v DisableRegistryTools /t REG_DWORD /d 1 /f
      2⤵
      • Disables RegEdit via registry modification
      • Modifies registry key
      PID:1948
    • C:\Windows\system32\REG.exe
      REG add HKCU\Software\Policies\Microsoft\Windows\System /v DisableCMD /t REG_DWORD /d 1 /f
      2⤵
      • Modifies registry key
      PID:1512

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • memory/544-54-0x000007FEF3490000-0x000007FEF3EB3000-memory.dmp
    Filesize

    10.1MB

    Download
  • memory/544-55-0x000007FEF1D10000-0x000007FEF2DA6000-memory.dmp
    Filesize

    16.6MB

    Download
  • memory/544-58-0x0000000002066000-0x0000000002085000-memory.dmp
    Filesize

    124KB

    Download
  • memory/544-59-0x0000000002066000-0x0000000002085000-memory.dmp
    Filesize

    124KB

    Download
  • memory/1512-57-0x0000000000000000-mapping.dmp
    Download
  • memory/1948-56-0x0000000000000000-mapping.dmp
    Download