Analysis

  • max time kernel
    150s
  • max time network
    153s
  • platform
    windows10-2004_x64
  • resource
    win10v2004-20220901-en
  • resource tags

    arch:x64arch:x86image:win10v2004-20220901-enlocale:en-usos:windows10-2004-x64system
  • submitted
    28/11/2022, 06:32

General

  • Target

    0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe

  • Size

    981KB

  • MD5

    6c7bb74133fa4462f030de13415108d1

  • SHA1

    61f2bc88935451f0525ccd9e2dba7ff00a3f641b

  • SHA256

    0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

  • SHA512

    534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

  • SSDEEP

    12288:rVTvRaeKGlHiM4lKD13YxWnVZunCAEJYQHxw88o8786sfRJ/kkkkckkkkbkkkhkh:tvbvlZVRhnbVAEa1YfJi

Score
10/10

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 4 IoCs
  • Executes dropped EXE 2 IoCs
  • Adds Run key to start application 2 TTPs 4 IoCs
  • Suspicious use of SetThreadContext 2 IoCs
  • Drops file in Windows directory 3 IoCs
  • Suspicious behavior: MapViewOfSection 4 IoCs
  • Suspicious use of WriteProcessMemory 9 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
    "C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe"
    1⤵
    • Suspicious use of SetThreadContext
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of WriteProcessMemory
    PID:4876
    • C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe
      "C:\Users\Admin\AppData\Local\Temp\0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b.exe"
      2⤵
      • Modifies firewall policy service
      • Adds Run key to start application
      • Drops file in Windows directory
      • Suspicious use of WriteProcessMemory
      PID:3588
      • C:\Windows\M-50507564324649683503740\winsvc.exe
        C:\Windows\M-50507564324649683503740\winsvc.exe
        3⤵
        • Executes dropped EXE
        • Suspicious use of SetThreadContext
        • Suspicious behavior: MapViewOfSection
        • Suspicious use of WriteProcessMemory
        PID:4688
        • C:\Windows\M-50507564324649683503740\winsvc.exe
          C:\Windows\M-50507564324649683503740\winsvc.exe
          4⤵
          • Executes dropped EXE
          PID:2000

Network

MITRE ATT&CK Enterprise v6

Replay Monitor

Loading Replay Monitor...

Downloads

  • C:\Windows\M-50507564324649683503740\winsvc.exe

    Filesize

    981KB

    MD5

    6c7bb74133fa4462f030de13415108d1

    SHA1

    61f2bc88935451f0525ccd9e2dba7ff00a3f641b

    SHA256

    0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

    SHA512

    534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

  • C:\Windows\M-50507564324649683503740\winsvc.exe

    Filesize

    981KB

    MD5

    6c7bb74133fa4462f030de13415108d1

    SHA1

    61f2bc88935451f0525ccd9e2dba7ff00a3f641b

    SHA256

    0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

    SHA512

    534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

  • C:\Windows\M-50507564324649683503740\winsvc.exe

    Filesize

    981KB

    MD5

    6c7bb74133fa4462f030de13415108d1

    SHA1

    61f2bc88935451f0525ccd9e2dba7ff00a3f641b

    SHA256

    0b8d380e9ff7c2cdd17b4e95d6663d1b21db1c955b0c933d68bd66c9c8b1b74b

    SHA512

    534aff749eda841c6d28c770b8a2b562e7c2021453976edf5e97e4ac29dfcdafe857ae11fbcf6c06dba5a38ed3feceee24a75901a925ca06eb03a7d8000392b1

  • memory/2000-140-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/3588-134-0x0000000000400000-0x000000000040F000-memory.dmp

    Filesize

    60KB

  • memory/4876-133-0x0000000002260000-0x0000000002268000-memory.dmp

    Filesize

    32KB