Overview

overview

10

Static

static

66d1b3771f...d3.exe

windows7-x64

10

66d1b3771f...d3.exe

windows10-2004-x64

7

Analysis

  • max time kernel
    137s
  • max time network
    154s
  • platform
    windows7_x64
  • resource
    win7-20220901-en
  • resource tags

    arch:x64arch:x86image:win7-20220901-enlocale:en-usos:windows7-x64system
  • submitted
    29/11/2022, 08:22

Sharing

Copy URL Twitter E-mail
Report Analysis Logs

General

  • Target

    66d1b3771f60732bfafea7f4c334eaa78048cd5351270179e8083052fffdd5d3.exe

  • Size

    156KB

  • MD5

    0598f36802ead7a73daf75b69a311200

  • SHA1

    6d4ffb3056da0acb97221a03d12fb8679df13ae1

  • SHA256

    66d1b3771f60732bfafea7f4c334eaa78048cd5351270179e8083052fffdd5d3

  • SHA512

    96491ab7c59e9aea60d61e12c7f836f5ae67ce73690f5db4e15cb959d8c8db066353bd6e3fb64516ce2eb5f95a8bc6a3820a1f59da584c92f9b471ce4d447c2d

  • SSDEEP

    3072:1R43bDohYpiuNORrppWhC1boZdv07yPaeaxxl58zXQmU1J0F:f43bDohY3O1ppgC1boZFun3/l58zgR+F

Score
10/10
evasionpersistence

Malware Config

Signatures

  • Modifies firewall policy service 2 TTPs 18 IoCs
    evasion
  • Modifies security service 2 TTPs 22 IoCs
    evasion
  • Sets service image path in registry 2 TTPs 1 IoCs
    persistence
  • Deletes itself 1 IoCs
  • Unexpected DNS network traffic destination 11 IoCs

    Network traffic to other servers than the configured DNS servers was detected on the DNS port.

  • Adds Run key to start application 2 TTPs 2 IoCs
    persistence
  • Drops desktop.ini file(s) 2 IoCs
  • Suspicious use of SetThreadContext 1 IoCs
  • Drops file in Program Files directory 22 IoCs
  • NTFS ADS 19 IoCs
  • Suspicious behavior: EnumeratesProcesses 5 IoCs
  • Suspicious behavior: GetForegroundWindowSpam 1 IoCs
  • Suspicious behavior: MapViewOfSection 2 IoCs
  • Suspicious use of AdjustPrivilegeToken 37 IoCs
  • Suspicious use of FindShellTrayWindow 2 IoCs
  • Suspicious use of SendNotifyMessage 2 IoCs
  • Suspicious use of WriteProcessMemory 5 IoCs

Processes

  • C:\Users\Admin\AppData\Local\Temp\66d1b3771f60732bfafea7f4c334eaa78048cd5351270179e8083052fffdd5d3.exe
    "C:\Users\Admin\AppData\Local\Temp\66d1b3771f60732bfafea7f4c334eaa78048cd5351270179e8083052fffdd5d3.exe"
    1⤵
    • Modifies security service
    • Sets service image path in registry
    • Adds Run key to start application
    • Suspicious use of SetThreadContext
    • Drops file in Program Files directory
    • NTFS ADS
    • Suspicious behavior: EnumeratesProcesses
    • Suspicious behavior: MapViewOfSection
    • Suspicious use of AdjustPrivilegeToken
    • Suspicious use of WriteProcessMemory
    PID:1492
    • C:\Windows\SysWOW64\cmd.exe
      "C:\Windows\system32\cmd.exe"
      2⤵
      • Deletes itself
      PID:584

Network

        MITRE ATT&CK Enterprise v6

        Replay Monitor

        Loading Replay Monitor...

        Downloads

        • C:\Program Files (x86)\Google\Desktop\Install\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\ \...\‮ﯹ๛\{d4e37f8e-5af0-9b64-e86d-0830097e992e}\@
          Filesize

          2KB

          MD5

          3a8cced2b7d1840002629a1b2d35b815

          SHA1

          4740945eadb806534dcae9a2b5e14fbcd1d2a18c

          SHA256

          d56af221c4117691d74f0f88bb4c1430bd1ca9c3cd0d351a3433637a85447e18

          SHA512

          0cb6730b19c1e448fada5fc87826277254f860694906d3a51af13a00cd0a46445fdd0be6068d0ce364ae5c954d8baf3240d4c26a9a967f4133ac440d0a82000c

          Download Submit

        • memory/468-59-0x0000000000780000-0x0000000000791000-memory.dmp

          Filesize

          68KB

          Download

        • memory/468-63-0x0000000000780000-0x0000000000791000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1424-58-0x0000000002560000-0x0000000002571000-memory.dmp

          Filesize

          68KB

          Download

        • memory/1492-54-0x0000000076BA1000-0x0000000076BA3000-memory.dmp

          Filesize

          8KB

          Download

        • memory/1492-57-0x0000000000230000-0x000000000025D000-memory.dmp

          Filesize

          180KB

          Download

        • memory/1492-56-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

          Download

        • memory/1492-55-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

          Download

        • memory/1492-61-0x0000000000400000-0x000000000042D000-memory.dmp

          Filesize

          180KB

          Download