Overview

overview

10

Static

static

a46a11f431...59.exe

windows7-x64

10

a46a11f431...59.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    165s
  • max time network
    192s
  • platform
    windows7_x64
  • resource
    win7-20221111-en
  • resource tags

    arch:x64arch:x86image:win7-20221111-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 04:03

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    a46a11f43181681814978059fbd1f9522ee40d52d559cf7e2535f7e9d6d77959.exe

  • Size

    187KB

  • MD5

    5d79b9abc8ffeb582925677af7ff0d47

  • SHA1

    18fc49e124dec8ef8a53157765b6043b7c78580a

  • SHA256

    a46a11f43181681814978059fbd1f9522ee40d52d559cf7e2535f7e9d6d77959

  • SHA512

    f90031b7a683e598c766c35fcba03349908ee7c10f91a0eb9248909c3bf78e4ae02229afef089254b490a51bb3f415d0b4ee357eb1948b3bec82803ba9477578

  • SSDEEP

    3072:i0CHU/GlIwVfYXnmya48P5jqUEA5d1xYu1K8Pq:iv0u2eMmE8xvEAVxY0K8Pq

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 22 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 22 IoCs
  • NTFS ADS 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 4 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of UnmapMainImage 1 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\a46a11f43181681814978059fbd1f9522ee40d52d559cf7e2535f7e9d6d77959.exe
    "C:\Users\Admin\AppData\Local\Temp\a46a11f43181681814978059fbd1f9522ee40d52d559cf7e2535f7e9d6d77959.exe"
    1⤵
    • Modifies security service
    • Sets service image path in registry
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of UnmapMainImage
    • Suspicious use of WriteProcessMemory
    PID:1776
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Deletes itself
      PID:1540

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Google\Desktop\Install\{f6ae883d-87b2-8e92-33b2-e7745dda3830}\ \...\‮ﯹ๛\{f6ae883d-87b2-8e92-33b2-e7745dda3830}\@
          Filesize

          2KB

          MD5

          ab73511a478e2b2c683e4108abd802f8

          SHA1

          30c30c409cce3034ad275f37f2665df65e2feefe

          SHA256

          7a047d00f56437151adf510aa38a404f57b5c14ca8581697629a88972de7baa1

          SHA512

          a11c52889a92f541dca5b61fc5ce82ffcc0f45898c964a1719940a93241603d944cb207ed67ffb79a5048d2fe211d49981b11586736434d018ef979b5526ca6a

          Download Submit

        • memory/464-58-0x0000000000080000-0x000000000008E000-memory.dmp

          Filesize

          56KB

          Download

        • memory/1264-57-0x0000000002160000-0x000000000216E000-memory.dmp

          Filesize

          56KB

          Download

        • memory/1264-60-0x000007FEF61E0000-0x000007FEF6323000-memory.dmp

          Filesize

          1.3MB

          Download

        • memory/1264-61-0x000007FE9D170000-0x000007FE9D17A000-memory.dmp

          Filesize

          40KB

          Download

        • memory/1776-54-0x0000000000260000-0x0000000000280000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1776-55-0x0000000075F01000-0x0000000075F03000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1776-56-0x0000000000400000-0x0000000000434000-memory.dmp

          Filesize

          208KB

          Download

        • memory/1776-59-0x0000000000260000-0x0000000000280000-memory.dmp

          Filesize

          128KB

          Download

        • memory/1776-63-0x0000000000400000-0x000000000041F000-memory.dmp

          Filesize

          124KB

          Download